{{- if .Values.enableRunAIRbac }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dgxc-customer-app-admin
  labels:
    dgxc/system-managed: "true"
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      dgxc/customer-app-admin: "true"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dgxc-customer-app-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dgxc-customer-app-admin
subjects:
{{- range $k, $v := .Values.tenantSubjects }}
{{- range $v }}
- apiGroup: rbac.authorization.k8s.io
  kind: {{ $k | quote }}
  name: {{ . | quote }}
{{- end }}
{{- end }}
{{- end }}
