---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: "{{ .Chart.Name }}-admin-{{ .Chart.Version }}"
  namespace: "{{ .Values.global.namespace }}"
  labels:
    app: "{{ .Chart.Name }}"
    version: "{{ .Chart.Version }}"
rules:
# EventListeners need to be able to fetch all namespaced resources
- apiGroups: ['triggers.tekton.dev']
  resources: ['eventlisteners', 'triggerbindings', 'triggertemplates', 'triggers']
  verbs: ['get', 'list', 'watch', 'create', 'patch', 'update']
- apiGroups: ['tekton.dev']
  resources: ['pipelineruns', 'pipelineresources', 'taskruns', 'tasks', 'pipelines', 'conditions']
  verbs: ['get', 'list', 'watch', 'create', 'patch', 'update']
- apiGroups: ['']
  # secrets are only needed for GitHub/GitLab interceptors
  # configmaps is needed for updating logging config
  #resources: ['configmaps', 'secrets']
  resources: ['configmaps']
  verbs: ['get', 'list', 'watch', 'create']
  # Permissions to create resources in associated TriggerTemplates
#- apiGroups: ['']
#  resources: ['serviceaccounts']
#  verbs: ['impersonate']
#- apiGroups: ['policy']
#  resources: ['podsecuritypolicies']
#  resourceNames: ['tekton-triggers']
#  verbs: ['use']
