{{- if .Values.rbac.create -}}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: {{ .Chart.Name }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
roleRef:
  kind: ClusterRole
  name: {{ template "fullname" . }}
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  namespace: {{ .Release.Namespace | quote }}
  name: {{ template "kube-spot-termination-notice-handler.serviceAccountName" . }}
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: {{ template "fullname" . }}
  labels:
    app: {{ template "fullname" . }}
    chart: {{ .Chart.Name }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
- apiGroups:
  - extensions
  resources:
  - replicasets
  - daemonsets
  verbs:
  - get
  - list
- apiGroups:
  - apps
  resources:
  - statefulsets
  verbs:
  - get
  - list
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - patch
- apiGroups:
  - ""
  resources:
  - pods/eviction
  verbs:
  - create
{{- end -}}
