This message was deleted.

Hi, I think it's not possible; you can specify crds by editing the YAML file manually.

thanks for the reply! i did it with terraform (resource rancher2_global_role), so i define the rules as:

rules {
    api_groups = ["*"]
    resources = ["customresourcedefinitions"]
    verbs = ["get", "list", "watch"]
  }

  rules {
    api_groups = ["*"]
    resources = ["customresourcedefinitions"]
    resource_names = ["<http://agents.agent.k8s.elastic.co|agents.agent.k8s.elastic.co>"]
    verbs = ["create", "delete"]
  }

I might doing it wrong , but what i want to achieve is to allow list/get/watch all CRDs, but be able to install only the CRD with name agents.agent.k8s.elastic.co

I think in your case, the correct YAML would be something like this in Rancher:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-role-creation
rules:
  - apiGroups:
      - agent.k8s.elastic.co/v1alpha1
    resources:
      - agent
    verbs:
      - create
      - get
      ...

Not sure how to define the same using Terraform. https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-api-agent-k8s-elastic-co-v1alpha1.html