{{- $rules := dict }}
{{- $crds := .Files.Get "crd.yaml" | splitList "---" }}
{{- $groups := dict }}
{{- range $crds }}
  {{- $crd := . | fromYaml }}
  {{- $group := $crd.spec.group }}
  {{- $plural:= $crd.spec.names.plural }}
  {{- $resources := get $groups $group | default (list) }}
  {{- $resources = concat $resources (list $plural (printf "%s/finalizers" $plural) (printf "%s/status" $plural)) }}
  {{- $groups = set $groups $group $resources }}
{{- end }}

{{- $verbs := dict "admin" (list "*") "view" (list "get" "list" "watch") }}
{{- range $group, $resources := $groups }}
  {{- range $name, $v := $verbs }}
    {{- $r := index $rules $name | default list -}}
    {{- $r = append $r (dict "apiGroups" (list $group) "resources" $resources "verbs" $v) -}}
    {{- $_ := set $rules $name $r }}
  {{- end }}
{{- end -}}

{{- $ctx := dict "helm" . "extraLabels" .Values.extraLabels }}
{{- $fullname := include "vm.plain.fullname" $ctx }}
{{- $ns := include "vm.namespace" $ctx }}

{{- if .Values.rbac.create }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $fullname }}
  labels: {{ include "vm.labels" $ctx | nindent 4 }}
  {{- with .Values.annotations }}
  annotations: {{ toYaml . | nindent 4 }}
  {{- end }}
  namespace: {{ $ns }}
rules:
- apiGroups:
  - coordination.k8s.io
  verbs:
  - create
  - get
  - update
  resources:
  - leases

{{- $watchNamespaces := (fromYaml (tpl (toYaml (dict "ns" .Values.watchNamespaces)) .)).ns }}
{{- $selfNamespace := $ns }}
{{- $watchSelfNamespace := (and (eq (len $watchNamespaces) 1) (eq (first $watchNamespaces) $selfNamespace)) }}
{{- if not $watchSelfNamespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ $fullname }}
  labels: {{ include "vm.labels" $ctx | nindent 4 }}
  {{- with .Values.annotations }}
  annotations: {{ toYaml . | nindent 4 }}
  {{- end }}
rules:
- nonResourceURLs: {{ toYaml .Values.allowedMetricsEndpoints | nindent 2 }}
  verbs:
  - get
  - watch
  - list
{{- end }}
- apiGroups:
  - ""
  resources:
  - configmaps
  - configmaps/finalizers
  - endpoints
  - events
  - persistentvolumeclaims
  - persistentvolumeclaims/finalizers
  - pods
  - pods/eviction
  - secrets
  - secrets/finalizers
  - services
  - services/finalizers
  - serviceaccounts
  - serviceaccounts/finalizers
  verbs:
  - "*"
- apiGroups:
  - ""
  resources:
  - configmaps/status
  - nodes
  - nodes/metrics
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - daemonsets
  - daemonsets/finalizers
  - deployments
  - deployments/finalizers
  - replicasets
  - statefulsets
  - statefulsets/finalizers
  - statefulsets/status
  verbs:
  - "*"
- apiGroups:
  - monitoring.coreos.com
  resources:
  - "*"
  verbs:
  - "*"
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterrolebindings/finalizers
  - clusterroles
  - clusterroles/finalizers
  - roles
  - rolebindings
  verbs:
  - "*"
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  verbs:
  - list
  - get
  - watch
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  - poddisruptionbudgets/finalizers
  verbs:
  - "*"
- apiGroups:
  - route.openshift.io
  - image.openshift.io
  resources:
  - routers/metrics
  - registry/metrics
  verbs:
  - get
- apiGroups:
  - autoscaling
  verbs:
  - "*"
  resources:
  - horizontalpodautoscalers
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  - ingresses/finalizers
  verbs:
  - "*"
- apiGroups:
    - gateway.networking.k8s.io
  resources:
    - httproutes
    - httproutes/finalizers
  verbs:
    - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - list
  - watch
  - get
{{- with $rules.admin }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{- if .Values.crds.cleanup.enabled }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ $fullname }}-cleanup-hook
  namespace: {{ $ns }}
  labels: {{ include "vm.labels" $ctx | nindent 4 }}
  annotations: {{ include "vm-operator.cleanup.annotations" (dict "hookWeight" "-5") | nindent 4 }}
rules: {{ toYaml $rules.admin | nindent 2 }}
{{- end }}

{{- if .Values.rbac.aggregatedClusterRoles.enabled }}
{{- /* This template generates readonly and admin cluster roles for */ -}}
{{- /* each CRD present in the helm chart.  The clusterroles use the */ -}}
{{- /* kubernetes clusterrole aggregation feature to include these */ -}}
{{- /* cluster roles into the default view and admin roles */ -}}
{{- /* See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles */}}
--- 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ $fullname }}-victoriametrics-admin
  labels:
    {{- include "vm.labels" $ctx | nindent 4 }}
    {{- .Values.rbac.aggregatedClusterRoles.labels.admin | toYaml | nindent 4 }}
rules: {{ toYaml ($rules.admin | default list) | nindent 2 }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ $fullname }}-victoriametrics-view
  labels:
    {{- include "vm.labels" $ctx | nindent 4 }}
    {{- .Values.rbac.aggregatedClusterRoles.labels.view | toYaml | nindent 4 }}
rules: {{ toYaml ($rules.view | default list) | nindent 2 }}
{{- end }}
