{{- if .Values.rbac.create -}}
# Read-only ClusterRole for kubectl-mcp-server.
#
#   * get/list/watch ONLY — no create/update/patch/delete anywhere. This is
#     the enforcement layer behind the server's own deny-by-default allowlist
#     (the server never registers any write/destructive tool).
#   * `secrets` is EXCLUDED from core resources — the RCA bot has no business
#     reading Secret payloads, and the server omits get_secrets entirely.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "kubectl-mcp-server.name" . }}
  labels:
    {{- include "kubectl-mcp-server.labels" . | nindent 4 }}
rules:
  # Core API resources - read access (secrets intentionally omitted)
  - apiGroups: [""]
    resources:
      - pods
      - pods/log
      - pods/status
      - services
      - endpoints
      - persistentvolumeclaims
      - persistentvolumes
      - configmaps
      - serviceaccounts
      - namespaces
      - nodes
      - nodes/status
      - events
      - resourcequotas
      - limitranges
      - replicationcontrollers
    verbs: ["get", "list", "watch"]

  # Apps API resources
  - apiGroups: ["apps"]
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs: ["get", "list", "watch"]

  # Batch API resources
  - apiGroups: ["batch"]
    resources:
      - jobs
      - cronjobs
    verbs: ["get", "list", "watch"]

  # Networking API resources
  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
      - networkpolicies
      - ingressclasses
    verbs: ["get", "list", "watch"]

  # Storage API resources
  - apiGroups: ["storage.k8s.io"]
    resources:
      - storageclasses
      - volumeattachments
      - csidrivers
      - csinodes
    verbs: ["get", "list", "watch"]

  # RBAC API resources
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources:
      - roles
      - rolebindings
      - clusterroles
      - clusterrolebindings
    verbs: ["get", "list", "watch"]

  # Autoscaling API resources
  - apiGroups: ["autoscaling"]
    resources:
      - horizontalpodautoscalers
    verbs: ["get", "list", "watch"]

  # Policy API resources
  - apiGroups: ["policy"]
    resources:
      - poddisruptionbudgets
    verbs: ["get", "list", "watch"]

  # API extensions
  - apiGroups: ["apiextensions.k8s.io"]
    resources:
      - customresourcedefinitions
    verbs: ["get", "list", "watch"]

  # Admissionregistration API
  - apiGroups: ["admissionregistration.k8s.io"]
    resources:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verbs: ["get", "list", "watch"]

  # Certificates API
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - certificatesigningrequests
    verbs: ["get", "list", "watch"]

  # Coordination API
  - apiGroups: ["coordination.k8s.io"]
    resources:
      - leases
    verbs: ["get", "list", "watch"]

  # Metrics API for resource usage (kubectl top)
  - apiGroups: ["metrics.k8s.io"]
    resources:
      - nodes
      - pods
    verbs: ["get", "list"]

  # Discovery API
  - apiGroups: ["discovery.k8s.io"]
    resources:
      - endpointslices
    verbs: ["get", "list", "watch"]

  # KEDA + Argo Rollouts CRs (read-only) — common at Meesho, used by the
  # server's keda_* / rollouts_* inspection tools
  - apiGroups: ["keda.sh"]
    resources:
      - scaledobjects
      - scaledjobs
      - triggerauthentications
    verbs: ["get", "list", "watch"]
  - apiGroups: ["argoproj.io"]
    resources:
      - rollouts
      - analysisruns
      - analysistemplates
    verbs: ["get", "list", "watch"]

  # Contour CRs (read-only) — Meesho ingress is Contour HTTPProxy almost
  # everywhere; needed to answer "what's the route/hostname for service X"
  - apiGroups: ["projectcontour.io"]
    resources:
      - httpproxies
      - tlscertificatedelegations
      - extensionservices
    verbs: ["get", "list", "watch"]

  # Flagger canaries (read-only) — canary.enabled is standard in the 2.0.0
  # chart; lets the server explain canary rollout state
  - apiGroups: ["flagger.app"]
    resources:
      - canaries
      - metrictemplates
    verbs: ["get", "list", "watch"]
{{- end }}