#@ load("@ytt:data", "data")
#@ load("@ytt:template", "template")

#@ def labelSafe(str):
#@   return str.replace("+", "_")
#@ end

#@ def labelSafe2(str):
#@   return str[:63].rstrip("-")
#@ end

#@ def labels():
  app.kubernetes.io/instance: #@ data.values.Release.Name
  app.kubernetes.io/managed-by: #@ data.values.Release.Service
  app.kubernetes.io/name: #@ labelSafe2(data.values.nameOverride or data.values.Chart.Name)
  app.kubernetes.io/version: #@ data.values.Chart.AppVersion or data.values.Chart.Version
  helm.sh/chart: #@ "{name}-{ver}".format(name=data.values.Chart.Name, ver=labelSafe(data.values.Chart.Version))
#@ end

#@ if/end data.values.kube.auth == "rbacz":
---
  apiVersion: "v1"
  kind: "ServiceAccount"
  metadata:
    name: "secret-generator"
    labels:
      app.kubernetes.io/component: "secret-generator"
      skiff-role-name: "secret-generator"
      _: #@ template.replace(labels())

#@ if data.values.kube.auth == "rbac":
---
apiVersion: "rbac.authorization.k8s.io/v1beta1"
kind: "RoleBinding"
metadata:
  name: "secret-generator-configgin-role-binding"
  labels:
    app.kubernetes.io/component: "secret-generator-configgin-role-binding"
    skiff-role-name: "secret-generator-configgin-role-binding"
    _: #@ template.replace(labels())
subjects:
- kind: "ServiceAccount"
  name: "secret-generator"
roleRef:
  kind: "Role"
  name: "configgin-role"
  apiGroup: "rbac.authorization.k8s.io"
---
apiVersion: "rbac.authorization.k8s.io/v1beta1"
kind: "RoleBinding"
metadata:
  name: "secret-generator-secrets-role-binding"
  labels:
    app.kubernetes.io/component: "secret-generator-secrets-role-binding"
    skiff-role-name: "secret-generator-secrets-role-binding"
    _: #@ template.replace(labels())
subjects:
- kind: "ServiceAccount"
  name: "secret-generator"
roleRef:
  kind: "Role"
  name: "secrets-role"
  apiGroup: "rbac.authorization.k8s.io"

#@ if/end data.values.kube.psp.nonprivileged:
---
  apiVersion: "rbac.authorization.k8s.io/v1"
  kind: "ClusterRoleBinding"
  metadata:
    name: #@ "{ns}-secret-generator-binding-psp".format(ns=data.values.Release.Namespace)
    labels:
      app.kubernetes.io/component: #@ "{ns}-secret-generator-binding-psp".format(ns=data.values.Release.Namespace)
      skiff-role-name: #@ "{ns}-secret-generator-binding-psp".format(ns=data.values.Release.Namespace)
      _: #@ template.replace(labels())
  subjects:
  - kind: "ServiceAccount"
    name: "secret-generator"
    namespace: #@ data.values.Release.Namespace
  roleRef:
    kind: "ClusterRole"
    name: #@ "{ns}-psp-role-nonprivileged".format(ns=data.values.Release.Namespace)
    apiGroup: "rbac.authorization.k8s.io"

---
apiVersion: "rbac.authorization.k8s.io/v1beta1"
kind: "Role"
metadata:
  name: "secrets-role"
  labels:
    app.kubernetes.io/component: "secrets-role"
    skiff-role-name: "secrets-role"
    _: #@ template.replace(labels())
rules:
- apiGroups:
  - ""
  resources:
  - "configmaps"
  - "secrets"
  verbs:
  - "create"
  - "get"
  - "list"
  - "patch"
  - "update"
  - "delete"
#@ end
