{{- if and .Values.rbac.create (hasKey .Values.scheduler "create" | ternary .Values.scheduler.create true) }}
kind: ServiceAccount
apiVersion: v1
metadata:
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.scheduler.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.scheduler.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
{{- if .Values.clusterScoped }}
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:{{ .Values.scheduler.schedulerName }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
rules:
# ConfigMap permission for --policy-configmap
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list"]
- apiGroups: ["pingcap.com"]
  resources: ["tidbclusters"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "update"]
# Extra permissions for endpoints other than kube-scheduler
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["create"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  {{- if eq .Values.appendReleaseSuffix true}}
  resourceNames: ["{{ .Values.scheduler.schedulerName }}-{{ .Release.Name }}"]
  {{- else }}
  resourceNames: ["{{ .Values.scheduler.schedulerName }}"]
  {{- end }}
  verbs: ["get", "update"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:{{ .Values.scheduler.schedulerName }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
- kind: ServiceAccount
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.scheduler.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.scheduler.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ .Release.Name }}:{{ .Values.scheduler.schedulerName }}
  apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if (not .Values.clusterScoped) }}
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:{{ .Values.scheduler.schedulerName }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
rules:
# ConfigMap permission for --policy-configmap
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list"]
- apiGroups: ["pingcap.com"]
  resources: ["tidbclusters"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "update"]
# Extra permissions for endpoints other than kube-scheduler
- apiGroups: [""]
  resources: ["endpoints"]
  verbs: ["delete", "get", "patch", "update"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["create"]
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  {{- if eq .Values.appendReleaseSuffix true}}
  resourceNames: {{ .Values.scheduler.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  resourceNames: ["{{ .Values.scheduler.schedulerName }}"]
  {{- end }}
  verbs: ["get", "update"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:{{ .Values.scheduler.schedulerName }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
- kind: ServiceAccount
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.scheduler.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.scheduler.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: Role
  name: {{ .Release.Name }}:{{ .Values.scheduler.schedulerName }}
  apiGroup: rbac.authorization.k8s.io
{{- end }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:kube-scheduler
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
- kind: ServiceAccount
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.scheduler.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.scheduler.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: system:kube-scheduler
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:volume-scheduler
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: scheduler
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
- kind: ServiceAccount
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.scheduler.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.scheduler.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: system:volume-scheduler
  apiGroup: rbac.authorization.k8s.io
{{- end }}