apiVersion: v1
kind: ServiceAccount
metadata:
  name: dapr-operator
  namespace: {{ .Release.Namespace }}
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
---
{{- if not .Values.global.rbac.namespaced }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dapr-operator-admin
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
rules:
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "patch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments/finalizers"]
    verbs: ["update"]
  - apiGroups: ["apps"]
    resources: ["statefulsets", "statefulsets/finalizers"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["statefulsets/finalizers"]
    verbs: ["update"]
  - apiGroups: [""]
    resources: ["pods"]
{{- if .Values.global.operator.watchdogCanPatchPodLabels }}
    verbs: ["get", "list", "delete", "watch", "patch"]
{{- else }}
    verbs: ["get", "list", "delete", "watch"]
{{- end }}
  - apiGroups: [""]
    resources: ["services","services/finalizers"]
    verbs: ["get", "list", "watch", "update", "create"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["dapr.io"]
    resources: ["components", "configurations", "subscriptions", "resiliencies", "httpendpoints"]
    verbs: [ "get", "list", "watch"]
{{- end }}
{{- if .Values.global.argoRolloutServiceReconciler.enabled }}
  - apiGroups: ["argoproj.io"]
    resources: ["rollouts"]
    verbs: ["get", "list", "watch", "delete"]
  - apiGroups: ["argoproj.io"]
    resources: ["rollouts/finalizers"]
    verbs: ["update"]
{{- end }}
---
{{- if not .Values.global.rbac.namespaced }}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dapr-operator-admin
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
subjects:
- kind: ServiceAccount
  name: dapr-operator
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dapr-operator-admin
{{- end }}
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dapr-operator
  namespace: {{ .Release.Namespace }}
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
rules:
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "update", "create"]
    resourceNames: ["operator.dapr.io", "webhooks.dapr.io"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "update", "create"]
    resourceNames: ["operator.dapr.io", "webhooks.dapr.io"]
# We cannot use resourceNames for create because Kubernetes doesn't nessarily
# know resource names at authorization time.
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["configmaps", "events"]
    verbs: ["create"]
{{- if eq .Values.global.rbac.namespaced true }}
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "patch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/finalizers"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments/finalizers"]
    verbs: ["update"]
  - apiGroups: ["apps"]
    resources: ["statefulsets", "statefulsets/finalizers"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["statefulsets/finalizers"]
    verbs: ["update"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "delete"]
  - apiGroups: [""]
    resources: ["services","services/finalizers"]
    verbs: ["get", "list", "watch", "update", "create"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["delete"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["dapr.io"]
    resources: ["components", "configurations", "subscriptions", "resiliencies", "httpendpoints"]
    verbs: [ "get", "list", "watch"]
{{- end }}
{{- if .Values.global.argoRolloutServiceReconciler.enabled }}
  - apiGroups: ["argoproj.io"]
    resources: ["rollouts"]
    verbs: ["get", "list", "watch", "delete"]
  - apiGroups: ["argoproj.io"]
    resources: ["rollouts/finalizers"]
    verbs: ["update"]
{{- end }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dapr-operator
  namespace: {{ .Release.Namespace }}
  labels:
    {{- range $key, $value := .Values.global.k8sLabels }}
    {{ $key }}: {{ tpl $value $ }}
    {{- end }}
subjects:
- kind: ServiceAccount
  name: dapr-operator
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: dapr-operator
