apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ .Values.wso2.apk.auth.roleName }}
  namespace: {{ .Release.Namespace }}
rules:
  - apiGroups: [""]
    resources: ["services", "configmaps", "secrets"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["httproutes", "grpcroutes"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["httproutes/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["apis"]
    verbs: ["get", "list", "watch", "update", "delete", "create", "patch"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["apis/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["apis/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["authentications"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["authentications/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["authentications/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["backends"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["backends/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["backends/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["apipolicies"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["apipolicies/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["grpcroutes"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["grpcroutes/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["grpcroutes/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["apipolicies/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["interceptorservices"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["interceptorservices/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["interceptorservices/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["scopes"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["scopes/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["scopes/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["ratelimitpolicies"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["ratelimitpolicies/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["ratelimitpolicies/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["airatelimitpolicies"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["airatelimitpolicies/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["airatelimitpolicies/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "update", "patch", "create", "delete"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["tokenissuers"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["tokenissuers/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["tokenissuers/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["backendjwts"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["backendjwts/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["backendjwts/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["gqlroutes"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["gqlroutes/finalizers"]
    verbs: ["update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["gqlroutes/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["aiproviders"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["aiproviders/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["dp.wso2.com"]
    resources: ["aiproviders/finalizers"]
    verbs: ["update"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["applications"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["applications/finalizers"]
    verbs: ["update"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["applications/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["subscriptions"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["subscriptions/finalizers"]
    verbs: ["update"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["subscriptions/status"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["applicationmappings"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["applicationmappings/finalizers"]
    verbs: ["update"]
  - apiGroups: ["cp.wso2.com"]
    resources: ["applicationmappings/status"]
    verbs: ["get", "patch", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ template "apk-helm.resource.prefix" . }}-role-binding
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: Role
  name: {{ .Values.wso2.apk.auth.roleName }}
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: {{ .Values.wso2.apk.auth.serviceAccountName }}
    namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "apk-helm.resource.prefix" . }}-gw-cluser-role
  namespace: {{ .Release.Namespace }}
rules:
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gateways", "gatewayclasses"]
    verbs: ["get", "list", "watch", "update", "delete", "create"]
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gateways/status", "gatewayclasses/status"]
    verbs: ["get", "patch", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "apk-helm.resource.prefix" . }}-cluster-role-binding
  namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ template "apk-helm.resource.prefix" . }}-gw-cluser-role
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name:  {{ .Values.wso2.apk.auth.serviceAccountName }}
    namespace: {{ .Release.Namespace }}