{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "kubernetes-agent.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "kubernetes-agent.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "kubernetes-agent.fullname" . }}
  labels:
    {{- include "kubernetes-agent.labels" . | nindent 4 }}
rules:
  # For k8s_cluster receiver and k8sattributes processor
  - apiGroups: [""]
    resources:
      - pods
      - nodes
      - nodes/proxy
      - nodes/stats
      - services
      - endpoints
      - namespaces
      - events
      - replicationcontrollers
      - resourcequotas
      - limitranges
      - configmaps
      - persistentvolumeclaims
      - persistentvolumes
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources:
      - jobs
      - cronjobs
    verbs: ["get", "list", "watch"]
  - apiGroups: ["autoscaling"]
    resources:
      - horizontalpodautoscalers
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources:
      - ingresses
    verbs: ["get", "list", "watch"]
  # For k8sobjects receiver to watch events
  - apiGroups: ["events.k8s.io"]
    resources:
      - events
    verbs: ["get", "list", "watch"]
  - apiGroups: ["autoscaling.k8s.io"]
    resources:
      - verticalpodautoscalers
    verbs: ["get", "list", "watch"]
{{- if and .Values.serviceMesh.enabled (eq .Values.serviceMesh.provider "istio") }}
  - apiGroups: ["networking.istio.io"]
    resources:
      - virtualservices
      - destinationrules
      - gateways
      - serviceentries
    verbs: ["get", "list", "watch"]
  - apiGroups: ["security.istio.io"]
    resources:
      - peerauthentications
      - authorizationpolicies
    verbs: ["get", "list", "watch"]
{{- end }}
  # For kubeletstats receiver
  - nonResourceURLs:
      - /metrics
      - /metrics/cadvisor
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "kubernetes-agent.fullname" . }}
  labels:
    {{- include "kubernetes-agent.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "kubernetes-agent.fullname" . }}
subjects:
  - kind: ServiceAccount
    name: {{ include "kubernetes-agent.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
