# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

{{/*
RBAC rules used to create the operator (cluster)role
*/}}
{{- define "spark-operator.operatorRbacRules" }}
rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - services
      - configmaps
      - persistentvolumeclaims
      - persistentvolumes
      - events
    verbs:
      - '*'
  - apiGroups:
      - "apps"
    resources:
      - statefulsets
    verbs:
      - '*'
  - apiGroups:
      - "spark.apache.org"
    resources:
      - '*'
    verbs:
      - '*'
{{- end }}

{{/*
Labels and annotations to be applied on rbacResources
*/}}
{{- define "spark-operator.rbacLabelsAnnotations" }}
  labels:
  {{- with .Values.operatorRbac.labels }}
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- include "spark-operator.commonLabels" . | nindent 4 }}
  {{- with .Values.operatorRbac.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}

---
# Service account and rolebindings for operator
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Values.operatorRbac.serviceAccount.name }}
  namespace: {{ .Release.Namespace }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
---
{{- if .Values.operatorRbac.clusterRoleBinding.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Values.operatorRbac.clusterRoleBinding.name }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Values.operatorRbac.clusterRole.name }}
subjects:
  - kind: ServiceAccount
    name: {{ .Values.operatorRbac.serviceAccount.name }}
    namespace: {{ .Release.Namespace }}
{{- end }}
---
{{- if .Values.operatorRbac.clusterRole.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Values.operatorRbac.clusterRole.name }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
{{- template "spark-operator.operatorRbacRules" $ }}
---
{{- end }}
{{- if .Values.operatorConfiguration.dynamicConfig.enable }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ .Values.operatorRbac.configManagement.roleName }}
  namespace: {{ .Release.Namespace }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ .Values.operatorRbac.configManagement.roleBindingName }}
  namespace: {{ .Release.Namespace }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ .Values.operatorRbac.configManagement.roleName }}
subjects:
  - kind: ServiceAccount
    name: {{ .Values.operatorRbac.serviceAccount.name }}
    namespace: {{ .Release.Namespace }}
---
{{- end }}

{{- $appResources := .Values.appResources -}}
{{- $systemNs := .Release.Namespace -}}
{{- $operatorRbac := .Values.operatorRbac -}}
{{- if index (.Values.appResources.namespaces) "data" }}
{{- range $appNs := .Values.appResources.namespaces.data }}
{{- if $operatorRbac.role.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $operatorRbac.role.name }}
  namespace: {{ $appNs }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
{{- template "spark-operator.operatorRbacRules" $ }}
---
{{- end }}
{{- if $operatorRbac.roleBinding.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ $operatorRbac.roleBinding.name }}
  namespace: {{ $appNs }}
{{- template "spark-operator.rbacLabelsAnnotations" $ }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: {{ $operatorRbac.roleBinding.roleRef.kind }}
  name: {{ $operatorRbac.roleBinding.roleRef.name }}
subjects:
  - kind: ServiceAccount
    name: {{ $operatorRbac.serviceAccount.name }}
    namespace: {{ $systemNs }}
---
{{- end }}
{{- end }}
{{- end }}
