{{/*
Delete permission is required in OpenShift because we can't own resources we created if we can't delete them.
*/}}
{{- if and .Values.rbac.create (hasKey .Values.controllerManager "create" | ternary .Values.controllerManager.create true) }}
kind: ServiceAccount
apiVersion: v1
metadata:
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.controllerManager.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.controllerManager.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
{{- if .Values.clusterScoped }}
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:tidb-controller-manager
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
rules:
- apiGroups: [""]
  resources:
  - services
  - events
  verbs: ["*"]
- apiGroups: [""]
  resources: ["endpoints","configmaps"]
  verbs: ["create", "get", "list", "watch", "update","delete"]
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["create","get","update","delete"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "update", "get", "list", "watch","delete"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch","update", "delete"]
- apiGroups: ["apps"]
  resources: ["statefulsets","deployments", "controllerrevisions"]
  verbs: ["*"]
- apiGroups: ["extensions"]
  resources: ["ingresses"]
  verbs: ["*"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["*"]
- apiGroups: ["apps.pingcap.com"]
  resources: ["statefulsets", "statefulsets/status"]
  verbs: ["*"]
- apiGroups: ["pingcap.com"]
  resources: ["*"]
  verbs: ["*"]
- nonResourceURLs: ["/metrics"]
  verbs: ["get"]
{{- if .Values.features | has "AdvancedStatefulSet=true" }}
- apiGroups:
  - apps.pingcap.com
  resources:
  - statefulsets
  verbs:
  - '*'
{{- end }}
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch", "update"]
- apiGroups: [""]
  resources: ["persistentvolumes"]
  verbs: ["get", "list", "watch", "patch", "update", "create"]
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["get", "list", "watch"]
{{/*
Allow controller manager to escalate its privileges to other subjects, the subjects may never have privilege over the controller.
Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping
*/}}
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: [clusterroles,roles]
  verbs: ["escalate","create","get","update", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings","clusterrolebindings"]
  verbs: ["create","get","update", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:tidb-controller-manager
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
- kind: ServiceAccount
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.controllerManager.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.controllerManager.serviceAccount }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ .Release.Name }}:tidb-controller-manager
  apiGroup: rbac.authorization.k8s.io
{{- else }}
{{/* when rendering the template inline, this defined templates are "string", so we need to use `eq * true` here */}}
{{- if or (eq (include "controller-manager.cluster-permissions.nodes" . | trim ) "true") (eq (include "controller-manager.cluster-permissions.persistentvolumes" . | trim) "true") (eq (include "controller-manager.cluster-permissions.storageclasses" . | trim) "true")}}
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:tidb-controller-manager
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
rules:
  {{- if (eq (include "controller-manager.cluster-permissions.nodes" . | trim) "true") }}
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch", "update"]
  {{- end }}
  {{- if (eq (include "controller-manager.cluster-permissions.persistentvolumes" . | trim) "true") }}
  - apiGroups: [""]
    resources: ["persistentvolumes"]
    verbs: ["get", "list", "watch", "patch","update"]
  {{- end }}
  {{- if (eq (include "controller-manager.cluster-permissions.storageclasses" . | trim) "true") }}
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  {{- end }}
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:tidb-controller-manager
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
  - kind: ServiceAccount
    {{- if eq .Values.appendReleaseSuffix true}}
    name: {{ .Values.controllerManager.serviceAccount }}-{{ .Release.Name }}
    {{- else }}
    name: {{ .Values.controllerManager.serviceAccount }}
    {{- end }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ .Release.Name }}:tidb-controller-manager
  apiGroup: rbac.authorization.k8s.io
{{- end }}
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:tidb-controller-manager
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
rules:
- apiGroups: [""]
  resources:
    - services
    - events
  verbs: ["*"]
- apiGroups: [""]
  resources: ["endpoints","configmaps"]
  verbs: ["create", "get", "list", "watch", "update", "delete"]
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["create","get","update","delete"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create", "update", "get", "list", "watch", "delete"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch","update", "delete"]
- apiGroups: ["apps"]
  resources: ["statefulsets","deployments", "controllerrevisions"]
  verbs: ["*"]
- apiGroups: ["apps.pingcap.com"]
  resources: ["statefulsets", "statefulsets/status"]
  verbs: ["*"]
- apiGroups: ["extensions"]
  resources: ["ingresses"]
  verbs: ["*"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["*"]
- apiGroups: ["pingcap.com"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles"]
  verbs: ["escalate","create","get","update", "delete"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["rolebindings"]
  verbs: ["create","get","update", "delete"]
{{- if .Values.features | has "AdvancedStatefulSet=true" }}
- apiGroups:
  - apps.pingcap.com
  resources:
  - statefulsets
  verbs:
  - '*'
{{- end }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ .Release.Name }}:tidb-controller-manager
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: {{ template "chart.name" . }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/component: controller-manager
    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
subjects:
- kind: ServiceAccount
  {{- if eq .Values.appendReleaseSuffix true}}
  name: {{ .Values.controllerManager.serviceAccount }}-{{ .Release.Name }}
  {{- else }}
  name: {{ .Values.controllerManager.serviceAccount }}
  {{- end }}
roleRef:
  kind: Role
  name: {{ .Release.Name }}:tidb-controller-manager
  apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- end }}