# ClusterRole for CRD and operator RBAC management during Helm upgrades
# Restricts access to only the 18 CRDs shipped by {product} and the
# cass-operator and k8ssandra-operator ClusterRoles and ClusterRoleBindings
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: helm-crd-upgrader
rules:
  # {product} CRDs - narrow scope via resourceNames
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "create", "update", "patch"]
    resourceNames:
      # K8ssandra CRDs
      - "k8ssandraclusters.k8ssandra.io"
      - "k8ssandratasks.control.k8ssandra.io"
      - "cassandradatacenters.cassandra.datastax.com"
      - "cassandratasks.control.k8ssandra.io"
      - "scheduledtasks.control.k8ssandra.io"
      - "clientconfigs.config.k8ssandra.io"
      - "replicatedsecrets.replication.k8ssandra.io"
      - "stargates.stargate.k8ssandra.io"
      - "reapers.reaper.k8ssandra.io"
      # Medusa CRDs
      - "medusabackupjobs.medusa.k8ssandra.io"
      - "medusabackups.medusa.k8ssandra.io"
      - "medusabackupschedules.medusa.k8ssandra.io"
      - "medusaconfigurations.medusa.k8ssandra.io"
      - "medusarestorejobs.medusa.k8ssandra.io"
      - "medusatasks.medusa.k8ssandra.io"
      # {product} CRDs
      - "missioncontrolclusters.missioncontrol.datastax.com"
      - "cqlconnectivities.missioncontrol.datastax.com"
      - "dataapis.missioncontrol.datastax.com"

  # ClusterRole and ClusterRoleBinding management for operators
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
    resourceNames:
      - "cass-operator-cluster-role"
      - "k8ssandra-operator-cluster-role"

  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings"]
    verbs: ["get", "list", "create", "update", "patch", "delete"]
    resourceNames:
      - "cass-operator-cluster-role"
      - "k8ssandra-operator-cluster-role"
