"default": "",
              "type": "string"
            },
            "type": "array",
            "x-kubernetes-list-type": "atomic"
          },
          "resourceNames": {
            "description": "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
            "items": {
              "default": "",
              "type": "string"

              "default": "",
              "type": "string"
            },
            "type": "array",
            "x-kubernetes-list-type": "atomic"
          },
          "resourceNames": {
            "description": "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
            "items": {
              "default": "",
              "type": "string"

metadata:
  name: calico-node
rules:
  # Used for creating service account tokens to be used by the CNI plugin
  - apiGroups: [""]
    resources:
      - serviceaccounts/token
    resourceNames:
      - calico-cni-plugin
    verbs:
      - create
  # The CNI plugin needs to get pods, nodes, and namespaces.
  - apiGroups: [""]
    resources:
      - pods
      - nodes