{{- /*
Standard (read-write) runner RBAC. When runner.readOnly is true this entire
file is skipped and templates/runner-service-account-readonly.yaml renders
instead — a strictly read-only ClusterRole plus a namespaced Role for the
release-namespace writes the agent needs (scanner Jobs, script-runner pods,
PrometheusRule CRUD). Keep the two files' READ rules in sync when adding
resources here.
*/}}
{{- if not .Values.runner.readOnly }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ include "nudgebee-agent.fullname" . }}-runner-cluster-role
  namespace : {{ .Release.Namespace }}
  {{ if .Values.runner.serviceAccount.annotations }}
  annotations:
    {{ toYaml .Values.runner.serviceAccount.annotations | indent 4 }}
  {{- end }}
rules:
  {{- if .Values.runner.customClusterRoleRules }}
{{ toYaml .Values.runner.customClusterRoleRules | indent 2 }}
  {{- end }}
  - apiGroups:
      - ""
    resources:
      - configmaps
      - daemonsets
      - deployments
      - events
      - namespaces
      - persistentvolumes
      - persistentvolumeclaims
      - pods
      - pods/status
      - pods/exec
      - pods/log
      - replicasets
      - replicationcontrollers
      - services
      - serviceaccounts
      - endpoints
      - secrets
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
      - watch
      - patch

  - apiGroups:
      - ""
    resources:
      - configmaps
      - persistentvolumes
      - persistentvolumeclaims
      - pods
      - pods/status
      - pods/exec
      - pods/log
      - pods/eviction
      - pods/ephemeralcontainers
    verbs:
      - delete
      - create
      - patch
      - update

  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - list
      - get

  - apiGroups:
      - "apiregistration.k8s.io"
    resources:
      - apiservices
    verbs:
      - get
      - list

  - apiGroups:
      - "rbac.authorization.k8s.io"
    resources:
      - clusterroles
      - clusterrolebindings
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "autoscaling"
    resources:
      - horizontalpodautoscalers
    verbs:
      - get
      - list
      - watch
      - patch
      - update

  - apiGroups:
      - apps
    resources:
      - daemonsets
      - deployments
      - deployments/scale
      - replicasets
      - replicasets/scale
      - statefulsets
    verbs:
      - get
      - list
      - watch
      - patch
      - update
      - delete

  - apiGroups:
      - extensions
    resources:
      - daemonsets
      - deployments
      - deployments/scale
      - ingresses
      - replicasets
      - replicasets/scale
      - replicationcontrollers/scale
    verbs:
      - get
      - list
      - watch
      - patch
      - update

  - apiGroups:
      - batch
    resources:
      - cronjobs
      - jobs
    verbs:
      - get
      - list
      - watch
      - patch
      - delete
      - create

  - apiGroups:
      - "events.k8s.io"
    resources:
      - events
    verbs:
      - get
      - list

  - apiGroups:
      - networking.k8s.io
    resources:
    - ingresses
    - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - autoscaling
    resources:
    - horizontalpodautoscalers
    verbs:
      - get
      - list
  - apiGroups:
      - "policy"
    resources:
    - poddisruptionbudgets
    - podsecuritypolicies
    verbs:
      - get
      - list
      - update
      - patch
  
  # Resources affected by API deprecations/deletions
  - apiGroups:
      - "scheduling.k8s.io"
    resources:
      - priorityclasses
    verbs:
      - get
      - list
      - watch
  
  - apiGroups:
      - "storage.k8s.io"
    resources:
      - storageclasses
      - volumeattachments
      - csidrivers
      - csinodes
      - csistoragecapacities
    verbs:
      - get
      - list
      - watch
  
  - apiGroups:
      - "coordination.k8s.io"
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
  
  - apiGroups:
      - "discovery.k8s.io"
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  
  - apiGroups:
      - "node.k8s.io"
    resources:
      - runtimeclasses
    verbs:
      - get
      - list
      - watch
  
  - apiGroups:
      - "admissionregistration.k8s.io"
    resources:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verbs:
      - get
      - list
      - watch
  
  - apiGroups:
      - "flowcontrol.apiserver.k8s.io"
    resources:
      - flowschemas
      - prioritylevelconfigurations
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
    - clusterroles
    - clusterrolebindings
    - roles
    - rolebindings
    verbs:
      - get
      - list

  - apiGroups:
      - cert-manager.io
    resources:
      - certificates
    verbs:
      - get
      - list
      - watch

  - apiGroups:
      - "monitoring.coreos.com"
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - delete
      - create
      - patch
      - update
      
  - apiGroups: ["metrics.k8s.io"]
    resources:
    - pods
    - nodes
    verbs:     ["get", "list"]

{{- if .Values.runner.enableWritePermissions }}
  # -- Write permissions (runner.enableWritePermissions) --

  # Node delete - required for node graceful shutdown (kubectl delete node)
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - delete

  # Service lifecycle management
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - create
      - update
      - patch
      - delete

  # Secret update/delete (base already has create/list/get)
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - update
      - patch
      - delete

  # Namespace creation
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - create
      - delete

  # Endpoint management
  - apiGroups:
      - ""
    resources:
      - endpoints
    verbs:
      - create
      - update
      - patch
      - delete

  # ServiceAccount management
  - apiGroups:
      - ""
    resources:
      - serviceaccounts
    verbs:
      - create
      - update
      - patch
      - delete

  # ResourceQuotas and LimitRanges
  - apiGroups:
      - ""
    resources:
      - resourcequotas
      - limitranges
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

  # StatefulSet scale subresource + create for all apps resources
  - apiGroups:
      - apps
    resources:
      - statefulsets/scale
    verbs:
      - get
      - list
      - watch
      - patch
      - update

  # Workload creation (create_workload action)
  - apiGroups:
      - apps
    resources:
      - deployments
      - statefulsets
      - daemonsets
      - replicasets
    verbs:
      - create

  # Ingress write access
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
      - networkpolicies
    verbs:
      - create
      - update
      - patch
      - delete

  # Extensions ingress write
  - apiGroups:
      - extensions
    resources:
      - ingresses
    verbs:
      - create
      - delete

  # RBAC read for roles/rolebindings (namespace-scoped)
  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      - roles
      - rolebindings
    verbs:
      - create
      - update
      - patch
      - delete
{{- end }}

  # Argo Rollouts permissions are granted unconditionally (same rationale as
  # karpenter below): an RBAC rule for an absent CRD is inert and becomes
  # active the moment Argo Rollouts is installed. Gating on .Capabilities left
  # clusters that installed the CRD after this chart without rollouts RBAC
  # until the next helm upgrade (and never worked under GitOps/templated
  # installs). The runner probes the CRD before registering informers, so the
  # grant is safe. Write verbs are gated behind runner.enableWritePermissions.
  - apiGroups:
    - argoproj.io
    resources:
    - rollouts
    - rollouts/scale
    verbs:
    - get
    - list
    - watch
    - patch
    - update
    # delete is unconditional for parity with the apps workloads block above
    # (delete_workload treats Deployment and Rollout identically); create
    # stays gated like create for apps kinds.
    - delete
{{- if .Values.runner.enableWritePermissions }}
    - create
{{- end }}

  # Karpenter read permissions are granted unconditionally. An RBAC rule for an
  # absent CRD is inert and becomes active the moment karpenter is installed.
  # This avoids stale RBAC under GitOps/templated installs (where .Capabilities
  # cannot see CRDs) or when karpenter is installed after this chart.
  # Write verbs are gated behind runner.enableWritePermissions.
  - apiGroups:
      - karpenter.sh
    resources:
      - nodepools
      - nodepools/status
      - nodeclaims
      - nodeclaims/status
    verbs:
      - get
      - list
      - watch
{{- if .Values.runner.enableWritePermissions }}
      - create
      - delete
      - patch
      - update
{{- end }}

  - apiGroups:
      - karpenter.k8s.aws
    resources:
      - ec2nodeclasses
    verbs:
      - get
      - list
      - watch
{{- if .Values.runner.enableWritePermissions }}
      - create
      - delete
      - update
      - patch
{{- end }}

  - apiGroups:
      - karpenter.azure.com
    resources:
      - aksnodeclasses
    verbs:
      - get
      - list
      - watch
{{- if .Values.runner.enableWritePermissions }}
      - create
      - delete
      - update
      - patch
{{- end }}

{{- if .Capabilities.APIVersions.Has "snapshot.storage.k8s.io/v1/VolumeSnapshot" }}
  - apiGroups:
      - snapshot.storage.k8s.io
    resources:
      - volumesnapshots
    verbs:
      - get
      - list
      - watch
      - create
      - update
{{- end }}

{{- if .Values.openshift.enabled }}
  - apiGroups:
    - security.openshift.io
    resources:
    - securitycontextconstraints
    verbs:
    - use
    resourceNames:
    - {{ if .Values.openshift.createScc }}"{{ include "nudgebee-agent.fullname" . }}-scc"{{ else }}{{ .Values.openshift.sccName | quote }}{{ end }}
  - apiGroups:
    - monitoring.coreos.com
    resources:
    - servicemonitors
    - prometheusrules
    - alertmanagers
    - silences
    - podmonitors
    verbs: 
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
    - deletecollection
{{- if .Values.openshift.createPrivilegedScc }}
    - {{ include "nudgebee-agent.fullname" . }}-scc-privileged
{{- end }}
{{- if .Values.openshift.privilegedSccName }}
    - {{ .Values.openshift.privilegedSccName }}
{{- end }}
{{- end }}

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "nudgebee-agent.fullname" . }}-runner-service-account
  namespace: {{ .Release.Namespace }}
{{- if .Values.runnerServiceAccount.imagePullSecrets }}
imagePullSecrets:
{{- toYaml .Values.runnerServiceAccount.imagePullSecrets | nindent 2}}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "nudgebee-agent.fullname" . }}-runner-cluster-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "nudgebee-agent.fullname" . }}-runner-cluster-role
subjects:
  - kind: ServiceAccount
    name: {{ include "nudgebee-agent.fullname" . }}-runner-service-account
    namespace: {{ .Release.Namespace }}
{{- if .Values.runner.scannerAutoCopyPullSecrets }}
---
# Auto-copy image-scan pull secrets (runner.scannerAutoCopyPullSecrets).
# The base ClusterRole already grants secrets get/list/watch + create cluster-wide;
# auto-copy additionally needs update/patch/delete to set the GC ownerReference
# on, and clean up, the copies. Those destructive verbs are scoped to THIS
# namespace only (where the copies live), not cluster-wide.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "nudgebee-agent.fullname" . }}-runner-scanner-pullsecrets
  namespace: {{ .Release.Namespace }}
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - update
      - patch
      - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "nudgebee-agent.fullname" . }}-runner-scanner-pullsecrets
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "nudgebee-agent.fullname" . }}-runner-scanner-pullsecrets
subjects:
  - kind: ServiceAccount
    name: {{ include "nudgebee-agent.fullname" . }}-runner-service-account
    namespace: {{ .Release.Namespace }}
{{- end }}
{{- end }}{{- /* end: not runner.readOnly */}}