{{ $watchedNamespaces := list }}
{{ if .Values.config.envoyGateway.provider.kubernetes }}
{{ $kube := .Values.config.envoyGateway.provider.kubernetes }}
{{ if $kube.watch }}
{{ if $kube.watch.namespaces }}
{{ if gt (len $kube.watch.namespaces) 0 }}
{{ $watchedNamespaces = $kube.watch.namespaces }}
{{ end }}
{{ end }}
{{ end }}
{{ end }}
{{ if gt (len $watchedNamespaces) 0 }}
{{ range $_, $ns := $watchedNamespaces }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: null
  name: {{ include "eg.fullname" $ }}-envoy-gateway-role
  namespace: {{ $ns | quote }}
rules:
{{ include "eg.rbac.namespaced" $ }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ include "eg.fullname" $ }}-envoy-gateway-rolebinding
  namespace: {{ $ns | quote }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ include "eg.fullname" $ }}-envoy-gateway-role
subjects:
- kind: ServiceAccount
  name: 'envoy-gateway'
  namespace: '{{ $.Release.Namespace }}'
{{ end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: {{ include "eg.fullname" . }}-envoy-gateway-role
rules:
{{ include "eg.rbac.cluster" . }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "eg.fullname" . }}-envoy-gateway-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "eg.fullname" . }}-envoy-gateway-role
subjects:
- kind: ServiceAccount
  name: 'envoy-gateway'
  namespace: '{{ .Release.Namespace }}'
{{ else }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: {{ include "eg.fullname" . }}-envoy-gateway-role
rules:
{{ include "eg.rbac.cluster" . }}
{{ include "eg.rbac.namespaced" . }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "eg.fullname" . }}-envoy-gateway-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "eg.fullname" . }}-envoy-gateway-role
subjects:
- kind: ServiceAccount
  name: 'envoy-gateway'
  namespace: '{{ .Release.Namespace }}'
{{ end }}