{{- if and .Values.rbac.create .Values.createAggregateRoles -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: strimzi-admin
  labels:
    app: {{ template "strimzi.name" . }}
    chart: {{ template "strimzi.chart" . }}
    component: entity-operator-role
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    # Add these permissions to the "admin" and "edit" default roles.
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
rules:
  - apiGroups:
      - "kafka.strimzi.io"
    resources:
      - kafkas
      - kafkanodepools
      - kafkanodepools/scale
      - kafkaconnects
      - kafkaconnects/scale
      - kafkausers
      - kafkatopics
      - kafkabridges
      - kafkabridges/scale
      - kafkaconnectors
      - kafkaconnectors/scale
      - kafkamirrormaker2s
      - kafkamirrormaker2s/scale
      - kafkarebalances
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - patch
      - update
  - apiGroups:
      - "core.strimzi.io"
    resources:
      - strimzipodsets
    verbs:
      - get
      - list
      - watch
      - create
      - delete
      - patch
      - update
{{- end -}}