{{- if .Values.rbac.create }}
# ─── Aggregated apiserver RBAC ───────────────────────────────────────────
# An aggregated apiserver (which is what a cert-manager external webhook
# is) needs to delegate auth/authz back to the kube-apiserver. The
# `extension-apiserver-authentication-reader` ClusterRole and the
# `system:auth-delegator` ClusterRole are the standard pair documented in
# https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/
# — we bind both to the webhook's ServiceAccount.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:auth-delegator
  labels:
    {{- include "bp-cert-manager-dynadot-webhook.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: {{ include "bp-cert-manager-dynadot-webhook.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:auth-reader
  namespace: kube-system
  labels:
    {{- include "bp-cert-manager-dynadot-webhook.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
  - kind: ServiceAccount
    name: {{ include "bp-cert-manager-dynadot-webhook.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
---
# ─── Dynadot credentials access ──────────────────────────────────────────
# The webhook reads the api-key, api-secret, and managed-domains list
# from the Dynadot secret in openova-system at startup. Two Roles are
# required because the binary does not run cross-namespace via
# informers — it just reads the K8s Secret directly via the projected
# volume in deployment.yaml. This Role exists ONLY so the chart can be
# pre-flight validated by `kubectl auth can-i get secret/...` from the
# webhook's SA, which the bootstrap-kit's gating contract checks before
# considering the chart Ready.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:dynadot-secret-reader
  namespace: {{ .Values.dynadot.credentialsSecret.namespace | default .Release.Namespace }}
  labels:
    {{- include "bp-cert-manager-dynadot-webhook.labels" . | nindent 4 }}
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["{{ .Values.dynadot.credentialsSecret.name }}"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:dynadot-secret-reader
  namespace: {{ .Values.dynadot.credentialsSecret.namespace | default .Release.Namespace }}
  labels:
    {{- include "bp-cert-manager-dynadot-webhook.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:dynadot-secret-reader
subjects:
  - kind: ServiceAccount
    name: {{ include "bp-cert-manager-dynadot-webhook.serviceAccountName" . }}
    namespace: {{ .Release.Namespace }}
---
# ─── Domain-solver RBAC ──────────────────────────────────────────────────────
# cert-manager's challenge controller needs to CREATE resources on the webhook's
# API group so it can dispatch DNS-01 challenges. Without this ClusterRole +
# ClusterRoleBinding the challenge controller gets:
#
#   dynadot.acme.dynadot.openova.io is forbidden: User
#   system:serviceaccount:cert-manager:cert-manager cannot create resource
#   dynadot in API group acme.dynadot.openova.io
#
# This is the pattern prescribed at
# https://cert-manager.io/docs/configuration/acme/dns01/webhook/#preparing-rbac
# — the ClusterRole grants create on `*` under the webhook's groupName, and
# is bound to cert-manager's ServiceAccount in cert-manager's namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:domain-solver
  labels:
    {{- include "bp-cert-manager-dynadot-webhook.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - {{ .Values.webhook.groupName }}
    resources:
      - "*"
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:domain-solver
  labels:
    {{- include "bp-cert-manager-dynadot-webhook.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "bp-cert-manager-dynadot-webhook.fullname" . }}:domain-solver
subjects:
  - kind: ServiceAccount
    name: {{ .Values.certManager.serviceAccountName }}
    namespace: {{ .Values.certManager.namespace }}
{{- end }}
