{{- if and .Values.querier.enabled .Values.querier.pspEnabled .Values.querier.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "thanos.fullname" . }}-querier
rules:
- apiGroups: ['policy']
  resources: ['podsecuritypolicies']
  verbs:     ['use']
  resourceNames:
  - {{ include "thanos.fullname" . }}-querier
{{- end -}}
