{{- $usePSP := (eq (include "mimir.rbac.usePodSecurityPolicy" .) "true") }}
{{- $useSCC := (eq (include "mimir.rbac.useSecurityContextConstraints" .) "true") }}
{{- if or $usePSP $useSCC }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "mimir.resourceName" (dict "ctx" .) }}
  labels:
    {{- include "mimir.labels" (dict "ctx" .) | nindent 4 }}
  namespace: {{ .Release.Namespace | quote }}
rules:
{{- if $usePSP }}
- apiGroups:      ['extensions']
  resources:      ['podsecuritypolicies']
  verbs:          ['use']
  resourceNames:  [{{ include "mimir.resourceName" (dict "ctx" .) }}]
{{- end }}
{{- if $useSCC }}
- apiGroups:
    - security.openshift.io
  resources:
    - securitycontextconstraints
  verbs:
    - use
  resourceNames:
    - {{ include "mimir.resourceName" (dict "ctx" .) }}
{{- end }}
{{- end }}