{{- if .Values.rbac.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: akri-controller-sa
  labels: {{- include "akri.labels" . | nindent 4 }}
    app.kubernetes.io/name: akri-controller
    app.kubernetes.io/component: controller
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: akri-agent-sa
  labels: {{- include "akri.labels" . | nindent 4 }}
    app.kubernetes.io/name: akri-agent
    app.kubernetes.io/component: agent
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: "akri-controller-role"
  labels: {{- include "akri.labels" . | nindent 4 }}
    app.kubernetes.io/name: akri-controller
    app.kubernetes.io/component: controller
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]
- apiGroups: [{{ .Values.crds.group | quote }}]
  resources: ["instances"]
  verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: [{{ .Values.crds.group | quote }}]
  resources: ["configurations"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: "akri-agent-role"
  labels: {{- include "akri.labels" . | nindent 4 }}
    app.kubernetes.io/name: akri-agent
    app.kubernetes.io/component: agent
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [{{ .Values.crds.group | quote }}]
  resources: ["instances"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [{{ .Values.crds.group | quote }}]
  resources: ["configurations"]
  verbs: ["get", "list", "watch"]
---
apiVersion: 'rbac.authorization.k8s.io/v1'
kind: 'ClusterRoleBinding'
metadata:
  name: 'akri-controller-binding'
  namespace: {{ .Release.Namespace }}
  labels: {{- include "akri.labels" . | nindent 4 }}
    app.kubernetes.io/name: akri-controller
    app.kubernetes.io/component: controller
roleRef:
  apiGroup: ''
  kind: 'ClusterRole'
  name: 'akri-controller-role'
subjects:
  - kind: 'ServiceAccount'
    name: 'akri-controller-sa'
    namespace: {{ .Release.Namespace }}
---
apiVersion: 'rbac.authorization.k8s.io/v1'
kind: 'ClusterRoleBinding'
metadata:
  name: 'akri-agent-binding'
  namespace: {{ .Release.Namespace }}
  labels: {{- include "akri.labels" . | nindent 4 }}
    app.kubernetes.io/name: akri-agent
    app.kubernetes.io/component: agent
roleRef:
  apiGroup: ''
  kind: 'ClusterRole'
  name: 'akri-agent-role'
subjects:
  - kind: 'ServiceAccount'
    name: 'akri-agent-sa'
    namespace: {{ .Release.Namespace }}
{{- end }}