#@ load("@ytt:data", "data")
#@ load("@ytt:template", "template")
#@ load("config.lib.yaml", "labels", "labels2")
#@ load("data2.lib.txt", "nameFromTextTemplate")

#@ if/end data.values.kube.auth == "rbacz":
---
  apiVersion: "v1"
  kind: "ServiceAccount"
  metadata:
    name: "secret-generator"
    labels:
      app.kubernetes.io/component: "secret-generator"
      skiff-role-name: "secret-generator"
      _: #@ template.replace(labels(data.values))

#@ if data.values.kube.auth == "rbac":
---
apiVersion: "rbac.authorization.k8s.io/v1beta1"
kind: "RoleBinding"
metadata:
  name: #@ data.read("data.txt")
  labels:
    app.kubernetes.io/component: #@ nameFromTextTemplate()
    skiff-role-name: #@ nameFromTextTemplate()
    _: #@ template.replace(labels(data.values))
subjects:
- kind: "ServiceAccount"
  name: "secret-generator"
roleRef:
  kind: "Role"
  name: "configgin-role"
  apiGroup: "rbac.authorization.k8s.io"
---
apiVersion: "rbac.authorization.k8s.io/v1beta1"
kind: "RoleBinding"
metadata:
  name: "secret-generator-secrets-role-binding"
  labels:
    app.kubernetes.io/component: "secret-generator-secrets-role-binding"
    skiff-role-name: "secret-generator-secrets-role-binding"
    _: #@ template.replace(labels2(data.values))
subjects:
- kind: "ServiceAccount"
  name: "secret-generator"
roleRef:
  kind: "Role"
  name: "secrets-role"
  apiGroup: "rbac.authorization.k8s.io"

#@ if/end data.values.kube.psp.nonprivileged:
---
  apiVersion: "rbac.authorization.k8s.io/v1"
  kind: "ClusterRoleBinding"
  metadata:
    name: #@ "{ns}-secret-generator-binding-psp".format(ns=data.values.Release.Namespace)
    labels:
      app.kubernetes.io/component: #@ "{ns}-secret-generator-binding-psp".format(ns=data.values.Release.Namespace)
      skiff-role-name: #@ "{ns}-secret-generator-binding-psp".format(ns=data.values.Release.Namespace)
      _: #@ template.replace(labels(data.values))
  subjects:
  - kind: "ServiceAccount"
    name: "secret-generator"
    namespace: #@ data.values.Release.Namespace
  roleRef:
    kind: "ClusterRole"
    name: #@ "{ns}-psp-role-nonprivileged".format(ns=data.values.Release.Namespace)
    apiGroup: "rbac.authorization.k8s.io"

---
apiVersion: "rbac.authorization.k8s.io/v1beta1"
kind: "Role"
metadata:
  name: "secrets-role"
  labels:
    app.kubernetes.io/component: "secrets-role"
    skiff-role-name: "secrets-role"
    _: #@ template.replace(labels2(data.values))
rules:
- apiGroups:
  - ""
  resources:
  - "configmaps"
  - "secrets"
  verbs:
  - "create"
  - "get"
  - "list"
  - "patch"
  - "update"
  - "delete"
#@ end
