{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
# The ClusterRole to enable the Connect injector to get, list, watch and patch MutatingWebhookConfiguration.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "consul.fullname" . }}-connect-injector
  labels:
    app: {{ template "consul.name" . }}
    chart: {{ template "consul.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
    component: connect-injector
rules:
- apiGroups:
  - consul.hashicorp.com
  resources:
  - servicedefaults
  - serviceresolvers
  - proxydefaults
  - meshes
  - exportedservices
  - servicerouters
  - servicesplitters
  - serviceintentions
  - ingressgateways
  - terminatinggateways
  {{- if .Values.global.peering.enabled }}
  - peeringacceptors
  - peeringdialers
  {{- end }}
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - consul.hashicorp.com
  resources:
  - servicedefaults/status
  - serviceresolvers/status
  - proxydefaults/status
  - meshes/status
  - exportedservices/status
  - servicerouters/status
  - servicesplitters/status
  - serviceintentions/status
  - ingressgateways/status
  - terminatinggateways/status
  {{- if .Values.global.peering.enabled }}
  - peeringacceptors/status
  - peeringdialers/status
  {{- end }}
  verbs:
  - get
  - patch
  - update
{{- if .Values.global.acls.manageSystemACLs }}
- apiGroups: [ "" ]
  resources: [ "serviceaccounts", "secrets" ]
  verbs:
  - get
{{- end }}
- apiGroups: [ "" ]
  resources: [ "endpoints", "services", "namespaces", "nodes" ]
  verbs:
  - "get"
  - "list"
  - "watch"
- apiGroups: [ "" ]
  resources:
  - pods
  verbs:
  - "get"
  - "list"
  - "watch"
  - "update"
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - list
  - update
{{- if (and .Values.global.secretsBackend.vault.enabled .Values.global.secretsBackend.vault.connectInjectRole .Values.global.secretsBackend.vault.connectInject.tlsCert.secretName  .Values.global.secretsBackend.vault.connectInject.caCert.secretName)}}
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  verbs:
  - get
  - list
  - watch
  - patch
{{- end }}
{{- if .Values.global.peering.enabled }}
- apiGroups: [ "" ]
  resources: [ "secrets" ]
  verbs:
  - "get"
  - "list"
  - "watch"
  - "create"
  - "update"
  - "delete"
{{- end }}
{{- if .Values.global.enablePodSecurityPolicies }}
- apiGroups: [ "policy" ]
  resources: [ "podsecuritypolicies" ]
  resourceNames:
  - {{ template "consul.fullname" . }}-connect-injector
  verbs:
  - use
{{- end }}
{{- end }}