{{- if and .Values.rbac.create .Values.createGlobalResources -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: strimzi-cluster-operator-watched
  labels:
    app: {{ template "strimzi.name" . }}
    chart: {{ template "strimzi.chart" . }}
    component: role
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
# Resources in this role are being watched by the operator. When operator is deployed as cluster-wide, these permissions
# need to be granted to the operator on a cluster wide level as well, even if the operands will be deployed only in
# few of the namespaces in given cluster. This is required to set up the Kubernetes watches and informers.
# Note: The rights included in this role might change in the future
- apiGroups:
  - ""
  resources:
    # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
  - pods
  verbs:
  - watch
  - list
- apiGroups:
  - "kafka.strimzi.io"
  resources:
  # The Cluster Operator operates the Strimzi custom resources
  - kafkas
  - kafkanodepools
  - kafkaconnects
  - kafkaconnectors
  - kafkabridges
  - kafkamirrormaker2s
  - kafkarebalances
  verbs:
  - get
  - list
  - watch
  - create
  - patch
  - update
- apiGroups:
  - "kafka.strimzi.io"
  resources:
  # The Cluster Operator needs to manage the status of the Strimzi custom resources
  - kafkas/status
  - kafkanodepools/status
  - kafkaconnects/status
  - kafkaconnectors/status
  - kafkabridges/status
  - kafkamirrormaker2s/status
  - kafkarebalances/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - "core.strimzi.io"
  resources:
  # The cluster operator uses StrimziPodSets to manage the Kafka, Kafka Connect, and Kafka MirrorMaker 2 pods
  - strimzipodsets
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - patch
  - update
- apiGroups:
  - "core.strimzi.io"
  resources:
  # The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
  - strimzipodsets/status
  verbs:
  - get
  - patch
  - update
- apiGroups:
    - "kafka.strimzi.io"
  resources:
    # The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
    - kafkarebalances
  verbs:
    - delete
{{- end -}}