apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "reports-server.fullname" . }}
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: 'true'
    rbac.authorization.k8s.io/aggregate-to-edit: 'true'
    rbac.authorization.k8s.io/aggregate-to-view: 'true'
    {{- include "reports-server.labels" . | nindent 4 }}
rules:
- apiGroups:
    - reports.kyverno.io
  resources:
    - ephemeralreports
    - clusterephemeralreports
  verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
    - deletecollection
- apiGroups:
    - ""
  resources:
    - namespaces
  verbs:
    - get
- apiGroups:
    - apiregistration.k8s.io
  resources:
    - apiservices
  verbs:
    - create
- apiGroups:
    - apiregistration.k8s.io
  resources:
    - apiservices
  verbs:
    - get
    - delete
    - update
    - patch
  resourceNames:
    - v1.reports.kyverno.io
    - v1alpha2.wgpolicyk8s.io
    - v1alpha1.openreports.io
- apiGroups:
    - wgpolicyk8s.io
  resources:
    - policyreports
    - policyreports/status
    - clusterpolicyreports
    - clusterpolicyreports/status
  verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
    - deletecollection
- apiGroups:
    - ''
    - events.k8s.io
  resources:
    - events
  verbs:
    - create
    - patch
- apiGroups:
    - authorization.k8s.io
  resources:
    - subjectaccessreviews
  verbs:
    - create
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ include "reports-server.fullname" . }}
  labels:
    {{- include "reports-server.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "reports-server.fullname" . }}
subjects:
- kind: ServiceAccount
  name: {{ include "reports-server.serviceAccountName" $ }}
  namespace: {{ $.Release.Namespace }}