{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
kind: ClusterRole
metadata:
  name: {{ template "external-dns.fullname" . }}
  labels: {{ include "external-dns.labels" . | nindent 4 }}
rules:
- apiGroups:
  - ""
  resources:
  - services
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  - "networking.k8s.io" # k8s 1.14+
  resources:
  - ingresses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.istio.io
  resources:
  - gateways
  verbs:
  - get
  - list
  - watch
{{- if or .Values.crd.create .Values.crd.apiversion }}
- apiGroups:
  {{- if .Values.crd.create }}
  - externaldns.k8s.io
  {{- else }}
  - {{ $api := splitn "/" 2 .Values.crd.apiversion }}{{ $api._0 }}
  {{- end }}
  resources:
  {{- if .Values.crd.create }}
  - dnsendpoints
  {{- else }}
  - {{ printf "%ss" (.Values.crd.kind | lower) }}
  {{- end }}
  verbs:
  - get
  - list
  - watch
- apiGroups:
  {{- if .Values.crd.create }}
  - externaldns.k8s.io
  {{- else }}
  - {{ $api := splitn "/" 2 .Values.crd.apiversion }}{{ $api._0 }}
  {{- end }}
  resources:
  {{- if .Values.crd.create }}
  - dnsendpoints/status
  {{- else }}
  - {{ printf "%ss/status" (.Values.crd.kind | lower) }}
  {{- end }}
  verbs:
  - update
{{- end }}
{{- end }}
