{{- $operatorValues :=  index .Values "reporting-operator" -}}
{{- if and $operatorValues.spec.authProxy.enabled (or $operatorValues.spec.authProxy.subjectAccessReview.enabled $operatorValues.spec.authProxy.delegateURLs.enabled) $operatorValues.spec.authProxy.rbac.createAuthProxyClusterRole }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Release.Namespace }}-reporting-operator-auth-proxy
  labels:
    app: reporting-operator
rules:
{{- if $operatorValues.spec.authProxy.subjectAccessReview.enabled }}
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
{{- end }}
{{- if $operatorValues.spec.authProxy.delegateURLs.enabled }}
- apiGroups:
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Release.Namespace }}-reporting-operator-auth-proxy
  labels:
    app: reporting-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Release.Namespace }}-reporting-operator-auth-proxy
subjects:
- kind: ServiceAccount
  name: reporting-operator
  namespace: {{ .Release.Namespace }}
{{- end }}
