{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Values.rbac.name }}
  namespace: {{ .Release.Namespace }}
  labels:
    mizu-cli-version: {{ .Chart.AppVersion }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
rules:
  - apiGroups: [ "", "extensions", "apps" ]
    resources: [ "endpoints", "pods", "services", "namespaces" ]
    verbs: [ "get", "list", "watch" ]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Values.rbac.roleBindingName }}
  labels:
    mizu-cli-version: {{ .Chart.AppVersion }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Values.rbac.name }}
subjects:
  - kind: ServiceAccount
    name: {{ .Values.serviceAccountName }}
    namespace: {{ .Release.Namespace }}
  {{- end -}}
