{{- $operatorValues :=  index .Values "reporting-operator" -}}
---
apiVersion: rbac.authorization.k8s.io/v1
{{- if $operatorValues.spec.config.allNamespaces }}
kind: ClusterRole
{{- else }}
kind: Role
{{- end }}
metadata:
{{- if $operatorValues.spec.config.allNamespaces }}
{{/* Prefix the namespace to the name of the ClusterRole since there could be multiple copies of this being installed */}}
  name: {{ .Release.Namespace }}-reporting-operator
{{- else }}
  name: reporting-operator
{{- end }}
  labels:
    app: reporting-operator
rules:
# grants access to all core metering types which the reporting-operator uses
- apiGroups: ["metering.openshift.io"]
  resources: ["*"]
  verbs: ["*"]
# grants access to leader election lock based on configmaps
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - delete
  - get
  - patch
  - update
  - watch
# grants access to creating and updating events
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
  - update

---

apiVersion: rbac.authorization.k8s.io/v1
{{- if $operatorValues.spec.config.allNamespaces }}
kind: ClusterRoleBinding
{{- else }}
kind: RoleBinding
{{- end }}
metadata:
{{- if $operatorValues.spec.config.allNamespaces }}
{{/* Prefix the namespace to the name of the ClusterRole since there could be multiple copies of this being installed */}}
  name: {{ .Release.Namespace }}-reporting-operator
{{- else }}
  name: reporting-operator
{{- end }}
  labels:
    app: reporting-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
{{- if $operatorValues.spec.config.allNamespaces }}
  kind: ClusterRole
  name: {{ .Release.Namespace }}-reporting-operator
{{- else }}
  kind: Role
  name: reporting-operator
{{- end }}
subjects:
- kind: ServiceAccount
  name: reporting-operator
  namespace: {{ .Release.Namespace }}
