{{ if .Values.config.envoyGateway.provider.kubernetes }}
{{ $kube := .Values.config.envoyGateway.provider.kubernetes }}
{{ if and (not $kube.watch) ($kube.deploy) (eq $kube.deploy.type "GatewayNamespace") }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "eg.fullname" $ }}-cluster-infra-manager
  labels:
  {{- include "eg.labels" $ | nindent 4 }}
rules:
{{ include "eg.rbac.infra.basic" . }}
{{ include "eg.rbac.infra.tokenreview" . }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "eg.fullname" $ }}-cluster-infra-manager
  labels:
  {{- include "eg.labels" $ | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: '{{ include "eg.fullname" $ }}-cluster-infra-manager'
subjects:
- kind: ServiceAccount
  name: 'envoy-gateway'
  namespace: '{{ $.Release.Namespace }}'
---
{{ end }}
{{ end }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "eg.fullname" . }}-infra-manager
  namespace: '{{ .Release.Namespace }}'
  labels:
  {{- include "eg.labels" . | nindent 4 }}
rules:
{{ include "eg.rbac.infra.basic" . }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "eg.fullname" . }}-infra-manager
  namespace: '{{ .Release.Namespace }}'
  labels:
  {{- include "eg.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: '{{ include "eg.fullname" . }}-infra-manager'
subjects:
- kind: ServiceAccount
  name: 'envoy-gateway'
  namespace: '{{ .Release.Namespace }}'