{{- if .Values.secretReader.enabled }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-reader
  namespace: {{ .Values.secretReader.namespace }}
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dapr-secret-reader
  namespace: {{ .Values.secretReader.namespace }}
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
subjects:
- kind: ServiceAccount
  name: default
roleRef:
  kind: Role
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io
{{- end }}
