{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kyverno.fullname" . }}:userinfo
  labels: {{ include "kyverno.labels" . | nindent 4 }}
    app: kyverno
rules:
- apiGroups:
  - "rbac.authorization.k8s.io"
  resources:
  - roles
  - clusterroles
  - rolebindings
  - clusterrolebindings
  verbs:
  - watch
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kyverno.fullname" . }}:policies
  labels: {{ include "kyverno.labels" . | nindent 4 }}
    app: kyverno
rules:
- apiGroups:
    - kyverno.io
  resources:
    - policies
    - policies/status
    - clusterpolicies
    - clusterpolicies/status
    - generaterequests
    - generaterequests/status
    - reportchangerequests
    - reportchangerequests/status
    - clusterreportchangerequests
    - clusterreportchangerequests/status
  verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
    - deletecollection
- apiGroups:
  - wgpolicyk8s.io
  resources:
  - policyreports
  - policyreports/status
  - clusterpolicyreports
  - clusterpolicyreports/status
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
  - deletecollection

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kyverno.fullname" . }}:view
  labels: {{ include "kyverno.labels" . | nindent 4 }}
    app: kyverno
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kyverno.fullname" . }}:generate
  labels: {{ include "kyverno.labels" . | nindent 4 }}
    app: kyverno
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
      - ingressclasses
      - networkpolicies
    verbs:
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - namespaces
      - configmaps
      - secrets
      - resourcequotas
      - limitranges
    verbs:
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - rolebindings
      - roles
    verbs:
      - create
      - update
      - patch
      - delete
  {{- if .Values.generatecontrollerExtraResources }}
  - apiGroups:
      - "*"
    resources:
    {{- range .Values.generatecontrollerExtraResources }}
      - {{ . }}
    {{- end }}
    verbs:
      - create
      - update
      - delete
  {{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kyverno.fullname" . }}:events
  labels: {{ include "kyverno.labels" . | nindent 4 }}
    app: kyverno
rules:
- apiGroups:
  - "*"
  resources:
  - events
  verbs:
  - create
  - update
  - patch
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "kyverno.fullname" . }}:webhook
  labels: {{ include "kyverno.labels" . | nindent 4 }}
    app: kyverno
rules:
- apiGroups:
  - 'admissionregistration.k8s.io'
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch

{{- end }}
