{{- if and .Values.rbac.create (not .Values.rbac.clusterAdminRole) }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  labels:
    app: {{ template "kubernetes-dashboard.name" . }}
    chart: {{ template "kubernetes-dashboard.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: {{ template "kubernetes-dashboard.fullname" . }}
  namespace: {{ .Release.Namespace }}
rules:
  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
- apiGroups:
    - ""
  resources:
    - secrets
  verbs:
    - create

  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
- apiGroups:
    - ""
  resources:
    - configmaps
  verbs:
    - create

  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
- apiGroups:
    - ""
  resources:
    - secrets
  resourceNames:
    - kubernetes-dashboard-key-holder
    - {{ template "kubernetes-dashboard.fullname" . }}
  verbs:
    - get
    - update
    - delete

  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
- apiGroups:
    - ""
  resources:
    - configmaps
  resourceNames:
    - kubernetes-dashboard-settings
  verbs:
    - get
    - update

  # Allow Dashboard to get metrics from heapster.
- apiGroups:
    - ""
  resources:
    - services
  resourceNames:
    - heapster
  verbs:
    - proxy
- apiGroups:
    - ""
  resources:
    - services/proxy
  resourceNames:
    - heapster
    - "http:heapster:"
    - "https:heapster:"
  verbs:
    - get
{{- end -}}
