{{- if or (and $.Values.crds.exclusive $.Values.crds.createRBAC) (not $.Values.crds.exclusive) }}
  {{- if $.Values.manager.rbac.create }}
{{- with .Values.manager.rbac.role.extraResources }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ include "capsule.fullname" $ }}:extra
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: capsule:{{ $.Release.Name }}:extra
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: capsule:{{ $.Release.Name }}:extra
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
rules:
  {{- toYaml . | nindent 2 }}
{{- end }}
    {{- with .Values.manager.rbac.clusterRole.extraResources }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ include "capsule.fullname" $ }}:extra
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: capsule:{{ $.Release.Name }}:extra
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: capsule:{{ $.Release.Name }}:extra
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
rules:
  {{- toYaml . | nindent 2 }}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: capsule:{{ .Release.Name }}:aggregate
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      projectcapsule.dev/aggregate-to-controller: "true"
  - matchLabels:
      projectcapsule.dev/aggregate-to-controller-instance: {{ .Release.Name }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ include "capsule.fullname" . }}:aggregate
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: capsule:{{ .Release.Name }}:aggregate
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
    {{- if or $.Values.manager.rbac.strict $.Values.manager.rbac.minimal }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ include "capsule.fullname" . }}:controller
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: capsule:{{ .Release.Name }}:controller
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: capsule:{{ .Release.Name }}:controller
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
rules:
- apiGroups:
    - "*"
  resources:
    - "*"
  verbs:
    - delete
    - deletecollection
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["impersonate"]
- apiGroups: ["events.k8s.io"]
  resources: ["events"]
  verbs: ["create", "patch"]
- apiGroups:
  - "capsule.clastix.io"
  resources:
  - capsuleconfigurations
  - capsuleconfigurations/status
  - resourcepoolclaims
  - resourcepoolclaims/status
  - resourcepools
  - resourcepools/status
  - tenantresources
  - tenantresources/status
  - globaltenantresources
  - globaltenantresources/status
  - tenants
  - tenants/status
  - tenantowners
  - tenantowners/status
  - rulestatuses
  - rulestatuses/status
  - customquotas
  - customquotas/status
  - globalcustomquotas
  - globalcustomquotas/status
  - globalresourcequotas
  - globalresourcequotas/status
  - quantityledgers
  - quantityledgers/status
  verbs:
  - create
  - delete
  - get
  - patch
  - update
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  resourceNames:
  - capsuleconfigurations.capsule.clastix.io
  - resourcepoolclaims.capsule.clastix.io
  - resourcepools.capsule.clastix.io
  - tenantresources.capsule.clastix.io
  - globaltenantresources.capsule.clastix.io
  - tenants.capsule.clastix.io
  - tenantowners.capsule.clastix.io
  - rulestatuses.capsule.clastix.io
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - "*"
  resources:
  - "*"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - ""
  resources:
  - "services"
  - "pods"
  - "persistentvolumes"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "patch"
  - "update"
- apiGroups:
  - ""
  resources:
  - "namespaces"
  - "namespaces/status"
  - "namespaces/finalize"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "patch"
  - "update"
  - "delete"
  - "create"
- apiGroups:
  - ""
  resources:
  - "limitranges"
  - "resourcequotas"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "create"
  - "patch"
  - "update"
  - "delete"
  - "deletecollection"
- apiGroups:
  - ""
  resources:
  - "secrets"
  verbs:
  - "list"
  - "watch"
- apiGroups:
  - "networking.k8s.io"
  resources:
  - "networkpolicies"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "create"
  - "patch"
  - "update"
  - "delete"
  - "deletecollection"
- apiGroups:
  - "discovery.k8s.io"
  resources:
  - "endpointslices"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "patch"
  - "update"
  - "delete"
  - "deletecollection"
- apiGroups:
  - "rbac.authorization.k8s.io"
  resources:
  - "rolebindings"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "create"
  - "patch"
  - "update"
  - "delete"
  - "deletecollection"
- apiGroups:
  - "gateway.networking.k8s.io"
  resources:
  - "gatewayclasses"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - "networking.k8s.io"
  resources:
  - "ingressclasses"
  - "ingresses"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - "node.k8s.io"
  resources:
  - "runtimeclasses"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - ""
  resources:
  - "nodes"
  - "resourcequotas"
  verbs:
  - "get"
  - "list"
  - "watch"
  - "patch"
  - "update"
- apiGroups:
  - "resource.k8s.io"
  resources:
  - "deviceclasses"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - "scheduling.k8s.io"
  resources:
  - "priorityclasses"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - "storage.k8s.io"
  resources:
  - "storageclasses"
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - watch
  - list
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - create
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  resourceNames:
  - "{{ include "capsule.fullname" . }}-mutating-webhook-configuration"
  - "{{ include "capsule.fullname" . }}-dynamic-webhook"
  verbs:
  - get
  - patch
  - update
  - delete
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  verbs:
  - watch
  - list
- apiGroups:
    - admissionregistration.k8s.io
  resources:
    - validatingwebhookconfigurations
  verbs:
    - create
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - validatingwebhookconfigurations
  resourceNames:
  -  {{ include "capsule.fullname" . }}-validating-webhook-configuration
  - "{{ include "capsule.fullname" . }}-dynamic-webhook"
  verbs:
  - get
  - patch
  - update
  - delete
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs:
  - "list"
  - "watch"
  - get
  - create
  - update
  - patch
  - delete
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  resourceNames:
    - {{ $.Values.manager.options.rbac.provisioner}}
    - {{ $.Values.manager.options.rbac.deleter}}
  verbs:
  - get
  - create
  - update
  - patch
  - delete
{{- $bindable := concat $.Values.manager.rbac.bindableClusterRoles (list $.Values.manager.options.rbac.provisioner $.Values.manager.options.rbac.deleter) $.Values.manager.options.rbac.administrationClusterRoles $.Values.manager.options.rbac.promotionClusterRoles | uniq | sortAlpha }}
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  resourceNames:
    {{- range $bindable }}
    - {{ . | quote }}
    {{- end }}
  verbs:
  - bind
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings"]
  verbs:
  - "list"
  - "watch"
  - get
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: capsule:{{ .Release.Name }}:controller
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
rules:
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "patch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ .Release.Name }}:controller
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: capsule:{{ .Release.Name }}:controller
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}
    {{- else }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ include "capsule.fullname" . }}-manager-rolebinding
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
    {{- end }}
  {{- end }}
  {{- range $_, $cr := $.Values.manager.rbac.existingClusterRoles }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ include "capsule.fullname" $ }}:{{ $cr }}
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ $cr }}
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}
{{- end }}
{{- range $_, $nr := $.Values.manager.rbac.existingRoles }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: capsule:{{ include "capsule.fullname" $ }}:{{ $nr }}
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "capsule.labels" $ | nindent 4 }}
  {{- with $.Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $nr }}
subjects:
- kind: ServiceAccount
  name: {{ include "capsule.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}
  {{- end }}
{{- end }}
