apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Values.provider.name }}-cluster-role
rules:
- apiGroups:
  - gcp.crossplane.io
  - compute.gcp.crossplane.io
  - iam.gcp.crossplane.io
  - storage.gcp.crossplane.io
  - bucketpolicy.storage.gcp.crossplane.io
  - bucketpolicymember.storage.gcp.crossplane.io
  - vpcpeering.gcp.crossplane.io
  - dns.gcp.crossplane.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  - configmaps/status
  - events
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Values.provider.name }}-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Values.provider.name }}-cluster-role
subjects:
- kind: ServiceAccount
  name: {{ .Values.provider.name }}
  namespace: {{ .Release.Namespace }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  {{- with .Values.provider.serviceAccount.annotations }}
  annotations:
  {{- toYaml . | nindent 4}}
  {{- end }}
  name: {{ .Values.provider.name }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Values.upstream.name }}-cluster-role
rules:
- apiGroups:
  - gcp.crossplane.io
  - dns.gcp.crossplane.io
  - cache.gcp.crossplane.io
  - cloudmemorystoreinstance.cache.gcp.crossplane.io
  - database.gcp.crossplane.io
  - cloudsqlinstance.database.gcp.crossplane.io
  - compute.gcp.crossplane.io
  - firewall.compute.gcp.crossplane.io
  - router.compute.gcp.crossplane.io
  - address.compute.gcp.crossplane.io
  - globaladdress.compute.gcp.crossplane.io
  - network.compute.gcp.crossplane.io
  - subnetwork.compute.gcp.crossplane.io
  - container.gcp.crossplane.io
  - nodepool.container.gcp.crossplane.io
  - cluster.container.gcp.crossplane.io
  - iam.gcp.crossplane.io
  - serviceaccount.iam.gcp.crossplane.io
  - serviceaccountkey.iam.gcp.crossplane.io
  - serviceaccountpolicy.iam.gcp.crossplane.io
  - kms.gcp.crossplane.io
  - cryptokey.kms.gcp.crossplane.io
  - cryptokeypolicy.kms.gcp.crossplane.io
  - keyring.kms.gcp.crossplane.io
  - pubsub.gcp.crossplane.io
  - topic.pubsub.gcp.crossplane.io
  - subscription.pubsub.gcp.crossplane.io
  - registry.gcp.crossplane.io
  - containerregistry.registry.gcp.crossplane.io
  - servicenetworking.gcp.crossplane.io
  - connection.servicenetworking.gcp.crossplane.io
  - storage.gcp.crossplane.io
  - bucket.storage.gcp.crossplane.io
  - bucketpolicy.storage.gcp.crossplane.io
  - bucketpolicymember.storage.gcp.crossplane.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  - configmaps/status
  - events
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Values.upstream.name }}-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Values.upstream.name }}-cluster-role
subjects:
- kind: ServiceAccount
  name: {{ .Values.upstream.name }}
  namespace: {{ .Release.Namespace }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  {{- with .Values.upstream.serviceAccount.annotations }}
  annotations:
  {{- toYaml . | nindent 4}}
  {{- end }}
  name: {{ .Values.upstream.name }}