{{ if .Values.enabledComponents.dgxcRunaiController }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dgxc-runai-controller
rules:
  - apiGroups: [""]
    resources: ["services", "configmaps", "secrets"]
    verbs: ["*"]
  - apiGroups: ["authentication.gke.io"]
    resources: ["clientconfigs"]
    verbs: ["*"]
  - apiGroups: ["run.ai"]
    resources: ["runaiconfigs"]
    verbs: ["*"]
  - apiGroups: ["runai.dgxc.nvidia.com", "storage.dgxc.nvidia.com", "kyverno.io"]
    resources: ["*"]
    verbs: ["*"]
  - apiGroups: [""]
    resources: ["persistentvolumes", "persistentvolumeclaims"]
    verbs: ["*"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings", "clusterroles", "roles", "rolebindings"]
    verbs: ["*"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "watch"]
{{ end }}
