{{- if and .Values.rbac.create .Values.createAggregateRoles -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: strimzi-view
  labels:
    app: {{ template "strimzi.name" . }}
    chart: {{ template "strimzi.chart" . }}
    component: entity-operator-role
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    # Add these permissions to the "view" default role.
    rbac.authorization.k8s.io/aggregate-to-view: "true"
rules:
  - apiGroups:
      - "kafka.strimzi.io"
    resources:
      - kafkas
      - kafkanodepools
      - kafkaconnects
      - kafkamirrormakers
      - kafkausers
      - kafkatopics
      - kafkabridges
      - kafkaconnectors
      - kafkamirrormaker2s
      - kafkarebalances
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "core.strimzi.io"
    resources:
      - strimzipodsets
    verbs:
      - get
      - list
      - watch
{{- end -}}
