{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: {{ .Values.namespaced | ternary "Role" "ClusterRole" }}
metadata:
  name: {{ template "external-dns.fullname" . }}
  labels:
    {{- include "external-dns.labels" . | nindent 4 }}
rules:
{{- if and (not .Values.namespaced) (or (has "node" .Values.sources) (has "pod" .Values.sources) (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources)) }}
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list","watch"]
{{- end }}
{{- if or (has "pod" .Values.sources) (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if or (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "service" .Values.sources }}
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) (has "gloo-proxy" .Values.sources) }}
  - apiGroups: ["extensions","networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if or (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) }}
  - apiGroups: ["networking.istio.io"]
    resources: ["gateways"]
    verbs: ["get","watch","list"]
{{- end }}

{{- if has "istio-virtualservice" .Values.sources }}
  - apiGroups: ["networking.istio.io"]
    resources: ["virtualservices"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "ambassador-host" .Values.sources }}
  - apiGroups: ["getambassador.io"]
    resources: ["hosts","ingresses"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "contour-httpproxy" .Values.sources }}
  - apiGroups: ["projectcontour.io"]
    resources: ["httpproxies"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "crd" .Values.sources }}
  - apiGroups: ["externaldns.k8s.io"]
    resources: ["dnsendpoints"]
    verbs: ["get","watch","list"]
  - apiGroups: ["externaldns.k8s.io"]
    resources: ["dnsendpoints/status"]
    verbs: ["*"]
{{- end }}
{{- if include "external-dns.hasGatewaySources" . }}
{{- if or (not .Values.namespaced) (and .Values.namespaced (not .Values.gatewayNamespace)) }}
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gateways"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if not .Values.namespaced }}
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get","watch","list"]
{{- end }}
{{- end }}
{{- if has "gateway-httproute" .Values.sources }}
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["httproutes"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "gateway-grpcroute" .Values.sources }}
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["grpcroutes"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "gateway-tlsroute" .Values.sources }}
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["tlsroutes"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "gateway-tcproute" .Values.sources }}
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["tcproutes"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "gateway-udproute" .Values.sources }}
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["udproutes"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "gloo-proxy" .Values.sources }}
  - apiGroups: ["gloo.solo.io","gateway.solo.io"]
    resources: ["proxies","virtualservices","gateways"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "kong-tcpingress" .Values.sources }}
  - apiGroups: ["configuration.konghq.com"]
    resources: ["tcpingresses"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "traefik-proxy" .Values.sources }}
  - apiGroups: ["traefik.containo.us", "traefik.io"]
    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "openshift-route" .Values.sources }}
  - apiGroups: ["route.openshift.io"]
    resources: ["routes"]
    verbs: ["get","watch","list"]
{{- end }}
{{- if has "skipper-routegroup" .Values.sources }}
  - apiGroups: ["zalando.org"]
    resources: ["routegroups"]
    verbs: ["get","watch","list"]
  - apiGroups: ["zalando.org"]
    resources: ["routegroups/status"]
    verbs: ["patch","update"]
{{- end }}
{{- if or (has "f5-virtualserver" .Values.sources) (has "f5-transportserver" .Values.sources) }}
  - apiGroups: ["cis.f5.com"]
    resources: ["virtualservers", "transportservers"]
    verbs: ["get","watch","list"]
{{- end }}
{{- with .Values.rbac.additionalPermissions }}
  {{- toYaml . | nindent 2 }}
{{- end }}
{{- if and .Values.rbac.create .Values.namespaced (include "external-dns.hasGatewaySources" .) }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "external-dns.fullname" . }}-namespaces
  labels:
    {{- include "external-dns.labels" . | nindent 4 }}
rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get","watch","list"]
{{- if .Values.gatewayNamespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ template "external-dns.fullname" . }}-gateway
  namespace: {{ .Values.gatewayNamespace }}
  labels:
    {{- include "external-dns.labels" . | nindent 4 }}
rules:
  - apiGroups: ["gateway.networking.k8s.io"]
    resources: ["gateways"]
    verbs: ["get","watch","list"]
{{- end }}
{{- end }}
{{- end }}