{{- if .Values.rbac.create -}}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "metallb.fullname" . }}:controller
  labels: {{- include "metallb.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - ''
    resources:
      - services
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - ''
    resources:
      - services/status
    verbs:
      - update
  - apiGroups:
      - ''
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - policy
    resourceNames:
      - {{ include "metallb.fullname" . }}-controller
    resources:
      - podsecuritypolicies
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "metallb.fullname" . }}:speaker
  labels: {{- include "metallb.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - ''
    resources:
      - services
      - endpoints
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ''
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - policy
    resourceNames:
      - {{ include "metallb.fullname" . }}-speaker
    resources:
      - podsecuritypolicies
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "metallb.fullname" . }}-config-watcher
  labels: {{- include "metallb.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - ''
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "metallb.fullname" . }}-pod-lister
  labels: {{- include "metallb.labels" . | nindent 4 }}
rules:
- apiGroups:
  - ''
  resources:
  - pods
  verbs:
  - list
---
## Role bindings
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "metallb.fullname" . }}:controller
  labels: {{- include "metallb.labels" . | nindent 4 }}
subjects:
- kind: ServiceAccount
  name: {{ include "metallb.controllerServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "metallb.fullname" . }}:controller
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "metallb.fullname" . }}:speaker
  labels: {{- include "metallb.labels" . | nindent 4 }}
subjects:
- kind: ServiceAccount
  name: {{ include "metallb.speakerServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "metallb.fullname" . }}:speaker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "metallb.fullname" . }}-config-watcher
  labels: {{- include "metallb.labels" . | nindent 4 }}
subjects:
- kind: ServiceAccount
  name: {{ include "metallb.controllerServiceAccountName" . }}
- kind: ServiceAccount
  name: {{ include "metallb.speakerServiceAccountName" . }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "metallb.fullname" . }}-config-watcher
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "metallb.fullname" . }}-pod-lister
  labels: {{- include "metallb.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "metallb.fullname" . }}-pod-lister
subjects:
- kind: ServiceAccount
  name: {{ include "metallb.speakerServiceAccountName" . }}
{{- end -}}
