{{- if (.Values.kubecostModel.etlReadOnlyMode) }}
{{- if and .Values.reporting .Values.reporting.logCollection -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: {{ .Release.Namespace }}
  name: {{ template "cost-analyzer.serviceAccountName" . }}
rules:
  - apiGroups: 
      - ''
    resources:
      - "pods/log"
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ''
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
{{- end -}}
{{- end -}}