{{- if .Values.rbac.create -}}
apiVersion: v1
kind: List
metadata: {}
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: servicecatalog.k8s.io:apiserver-authentication-reader
    labels:
      app: {{ template "cpi.name" . }}
      vsphere-cpi-infra: role-binding
      chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
      component: cloud-controller-manager
      heritage: {{ .Release.Service }}
      release: {{ .Release.Name }}
    namespace: {{ .Release.Namespace }}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: extension-apiserver-authentication-reader
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: {{ .Values.serviceAccount.name }}
    namespace: {{ .Release.Namespace }}
  - apiGroup: ""
    kind: User
    name: {{ .Values.serviceAccount.name }}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: {{ .Values.serviceAccount.name }}
    labels:
      app: {{ template "cpi.name" . }}
      vsphere-cpi-infra: cluster-role-binding
      chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
      component: cloud-controller-manager
      heritage: {{ .Release.Service }}
      release: {{ .Release.Name }}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: {{ .Values.serviceAccount.name }}
  subjects:
  - kind: ServiceAccount
    name: {{ .Values.serviceAccount.name }}
    namespace: {{ .Release.Namespace }}
  - kind: User
    name: {{ .Values.serviceAccount.name }}
{{- end -}}
