{{- if .Values.argoServiceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "{{ .Release.Name }}-{{ .Values.argoServiceAccount.name }}"
imagePullSecrets:
  {{ include "nemo-common.imagepullsecrets" . | nindent 2 | trim }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: "{{ .Release.Name }}-{{ .Values.argoServiceAccount.name }}-role"
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtaskresults
    verbs:
      - create
      - patch
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: "{{ .Release.Name }}-{{ .Values.argoServiceAccount.name }}-role-binding"
subjects:
- kind: ServiceAccount
  name: "{{ .Release.Name }}-{{ .Values.argoServiceAccount.name }}"
roleRef:
  kind: Role
  name: "{{ .Release.Name }}-{{ .Values.argoServiceAccount.name }}-role"
  apiGroup: rbac.authorization.k8s.io
{{- end }}
