{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "external-dns.fullname" . }}
  labels:
    {{- include "external-dns.labels" . | nindent 4 }}
rules:
{{- if or (has "node" .Values.sources) (has "pod" .Values.sources) (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list","watch"]
{{- end }}

{{- if or (has "pod" .Values.sources) (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if or (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
  - apiGroups: [""]
    resources: ["services","endpoints"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if or (has "ingress" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
  - apiGroups: ["extensions","networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if or (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) }}
  - apiGroups: ["networking.istio.io"]
    resources: ["gateways"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "istio-virtualservice" .Values.sources }}
  - apiGroups: ["networking.istio.io"]
    resources: ["virtualservices"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "ambassador-host" .Values.sources }}
  - apiGroups: ["getambassador.io"]
    resources: ["hosts","ingresses"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "contour-httpproxy" .Values.sources }}
  - apiGroups: ["projectcontour.io"]
    resources: ["httpproxies"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "contour-ingressroute" .Values.sources }}
  - apiGroups: ["contour.heptio.com"]
    resources: ["ingressroutes"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "crd" .Values.sources }}
  - apiGroups: ["externaldns.k8s.io"]
    resources: ["dnsendpoints"]
    verbs: ["get","watch","list"]
  - apiGroups: ["externaldns.k8s.io"]
    resources: ["dnsendpoints/status"]
    verbs: ["*"]
{{- end }}

{{- if has "gloo-proxy" .Values.sources }}
  - apiGroups: ["gloo.solo.io","gateway.solo.io"]
    resources: ["proxies","virtualservices"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "kong-tcpingress" .Values.sources }}
  - apiGroups: ["configuration.konghq.com"]
    resources: ["tcpingresses"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "openshift-route" .Values.sources }}
  - apiGroups: ["route.openshift.io"]
    resources: ["routes"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "skipper-routegroup" .Values.sources }}
  - apiGroups: ["zalando.org"]
    resources: ["routegroups"]
    verbs: ["get","watch","list"]
  - apiGroups: ["zalando.org"]
    resources: ["routegroups/status"]
    verbs: ["patch","update"]
{{- end }}

{{- with .Values.rbac.additionalPermissions }}
  {{- toYaml . | nindent 2 }}
{{- end }}

{{- end }}