{{- if and .Values.webhooksServer.enabled .Values.rbac.installClusterRoles }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kargo-webhooks-server
  labels:
    {{- include "kargo.labels" . | nindent 4 }}
    {{- include "kargo.webhooksServer.labels" . | nindent 4 }}
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - create
  - get
  - list
  - update
  - watch
- apiGroups:
    - ""
  resources:
    - events
  verbs:
    - create
    - patch
- apiGroups:
  - ""
  resources:
  - configmaps
  - secrets
  - serviceaccounts
  verbs:
  - "*"
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - rolebindings
  - roles
  verbs:
  - "*"
- apiGroups:
  - kargo.akuity.io
  resources:
  - freights
  - projects
  - stages
  - warehouses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - kargo.akuity.io
  resources:
  - project/status
  verbs:
  - patch
  - update
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
---
# This cluster role is custom for the namespace controller. The namespace
# controller will not actually be able to carry our promotions because it lacks
# permission to create Promotion resources, but having the custom promote verb
# on Stages allows it to delete Promotion resources associated with any Stage
# when a namespace is deleted. Without this, the webhook would prevent that.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kargo-webhooks-server-ns-controller
  labels:
    {{- include "kargo.labels" . | nindent 4 }}
    {{- include "kargo.webhooksServer.labels" . | nindent 4 }}
rules:
- apiGroups:
  - kargo.akuity.io
  resources:
  - stages
  verbs:
  - promote
---
# This cluster role is custom for the generic garbage collector. It will not
# actually be able to carry our promotions because it lacks permission to create
# Promotion resources, but having the custom promote verb on Stages allows it to
# delete Promotion resources associated with any Stage when the Stage is
# deleted. Without this, the webhook would prevent that and Stage deletions
# would not cascade to related Promotions.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kargo-webhooks-server-generic-gc
  labels:
    {{- include "kargo.labels" . | nindent 4 }}
    {{- include "kargo.webhooksServer.labels" . | nindent 4 }}
rules:
- apiGroups:
  - kargo.akuity.io
  resources:
  - stages
  verbs:
  - promote
{{- end }}
