{{- if .Values.rbac.create -}}
apiVersion: {{ template "rbac.apiVersion" . }}
kind: {{ if .Values.rbac.clusterWideAccess }}"ClusterRole"{{ else }}"Role"{{ end }}
metadata:
  name: {{ template "name" . }}
  # include labels for this service to identify it
{{- include "labels" . | indent 2 }}
rules:
{{- range .Values.rbac.rules }}

  {{- if .nonResourceURLs }}
  - nonResourceURLs: ["{{ join "\", \"" .nonResourceURLs }}"]
  {{- else if .apiGroups }}
  - apiGroups: ["{{ join "\", \"" .apiGroups }}"]
  {{- else }}
  - apiGroups: ["*"]
  {{- end }}

  {{- if .resources }}
    resources: ["{{ join "\", \"" .resources }}"]
  {{- else if not .nonResourceURLs }}
    resources: ["*"]
  {{- end }}

  {{- if .verbs }}
    verbs: ["{{ join "\", \"" .verbs }}"]
  {{- else }}
    verbs: ["*"]
  {{ end }}

{{- end }}
{{- end }}