---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: subscriber-role
  namespace: #{AGENT_NAMESPACE}
  labels:
    name: subscriber-role
rules:
  - apiGroups: [""]
    resources: ["configmaps", "secrets"]
    verbs: ["get", "create", "delete", "update"]

  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]

  - apiGroups: [""]
    resources: ["pods","services"]
    verbs: ["get", "list", "watch"]

  - apiGroups: ["litmuschaos.io"]
    resources: ["chaosengines", "chaosschedules", "chaosresults"]
    verbs: ["get", "list", "create", "delete", "update", "watch"]

  - apiGroups: ["apps.openshift.io"]
    resources: ["deploymentconfigs"]
    verbs: ["get", "list"]

  - apiGroups: ["apps"]
    resources: ["deployments", "daemonsets", "replicasets", "statefulsets"]
    verbs: ["get", "list", "delete","deletecollection"]

  - apiGroups: ["argoproj.io"]
    resources:
      [
        "workflows",
        "workflows/finalizers",
        "workflowtemplates",
        "workflowtemplates/finalizers",
        "cronworkflows",
        "cronworkflows/finalizers",
        "rollouts",
      ]
    verbs: ["get", "list", "create", "delete", "update", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: subscriber-role-binding
  namespace: #{AGENT_NAMESPACE}
subjects:
  - kind: ServiceAccount
    name: #{SUBSCRIBER_SERVICE_ACCOUNT}
    namespace: #{AGENT_NAMESPACE}
roleRef:
  kind: Role
  name: subscriber-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: litmus-admin
  namespace: #{AGENT_NAMESPACE}
  labels:
    name: litmus-admin
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: litmus-admin
  namespace: #{AGENT_NAMESPACE}
  labels:
    name: litmus-admin
rules:
  # ***************************************************************************************
  # Permissions needed for preparing and monitor the chaos resources by chaos-runner
  # ***************************************************************************************

  # The chaos operator watches the chaosengine resource and orchestartes the chaos experiment..
  ## .. by creating the chaos-runner

  # for creating and monitoring the chaos-runner pods
  - apiGroups: [""]
    resources: ["pods", "events"]
    verbs:
      ["create", "delete", "get", "list", "patch", "update", "deletecollection"]

    # for fetching configmaps and secrets to inject into chaos-runner pod (if specified)
  - apiGroups: [""]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "list"]

    # for tracking & getting logs of the pods created by chaos-runner to implement individual steps in the runner
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]

    # for configuring and monitor the experiment job by chaos-runner pod
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["create", "list", "get", "delete", "deletecollection"]

    # ********************************************************************
    # Permissions needed for creation and discovery of chaos experiments
    # ********************************************************************

    # The helper pods are created by experiment to perform the actual chaos injection ...
    # ... for a period of chaos duration

    # for creating and deleting the helper or target app pod and events by experiment
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "delete", "deletecollection"]

    # for creating and monitoring the events for chaos operations
  - apiGroups: [""]
    resources: ["events"]
    verbs:
      ["create", "delete", "get", "list", "patch", "update", "deletecollection"]

    # for monitoring the helper and target app pod
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "patch", "update"]

    # for creating and managing to execute comands inside target container
  - apiGroups: [""]
    resources: ["pods/exec", "pods/eviction", "replicationcontrollers"]
    verbs: ["get", "list", "create"]

    # for tracking & getting logs of the pods created by experiment pod to implement individual steps in the experiment
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get", "list", "watch"]

    # for creating and monitoring liveness services or monitoring target app services during chaos injection
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["create", "delete", "get", "list", "delete", "deletecollection"]

    # for checking the app parent resources as deployments or sts and are eligible chaos candidates
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets"]
    verbs: ["list", "get", "patch", "update"]

    # for checking the app parent resources as replicasets and are eligible chaos candidates
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["list", "get"]

    # for checking the app parent resources as deamonsets and are eligible chaos candidates
  - apiGroups: ["apps"]
    resources: ["daemonsets"]
    verbs: ["list", "get", "delete"]

    # for checking (openshift) app parent resources if they are eligible chaos candidates
  - apiGroups: ["apps.openshift.io"]
    resources: ["deploymentconfigs"]
    verbs: ["list", "get"]

    # for checking (argo) app parent resources if they are eligible chaos candidates
  - apiGroups: ["argoproj.io"]
    resources: ["rollouts"]
    verbs: ["list", "get"]

    # for creation, status polling and deletion of litmus chaos resources used within a chaos workflow
  - apiGroups: ["litmuschaos.io"]
    resources: ["chaosengines", "chaosexperiments", "chaosresults"]
    verbs: ["create", "list", "get", "patch", "update", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: litmus-admin
  namespace: #{AGENT_NAMESPACE}
  labels:
    name: litmus-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: litmus-admin
subjects:
  - kind: ServiceAccount
    name: litmus-admin
    namespace: #{AGENT_NAMESPACE}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argo-chaos
  namespace: #{AGENT_NAMESPACE}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: chaos-role
  namespace: #{AGENT_NAMESPACE}
rules:
  # for managing the pods created by workflow controller to implement individual steps in the workflow
  - apiGroups: [""]
    resources: ["pods", "services"]
    verbs: ["create", "get", "watch", "patch", "delete", "list"]

  # for tracking & getting logs of the pods created by workflow controller to implement individual steps in the workflow
  - apiGroups: ['']
    resources: ['pods/log', 'secrets', 'configmaps']
    verbs: ['get', 'watch', 'create', 'delete', 'patch']

  # for creation & deletion of application in predefined workflows
  - apiGroups: ["apps"]
    resources: ['deployments', 'statefulsets']
    verbs: ['get', 'watch', 'patch' , 'create', 'delete']

  # for creation, status polling and deletion of litmus chaos resources used within a chaos workflow
  - apiGroups: ["litmuschaos.io"]
    resources:
      ["chaosengines", "chaosexperiments", "chaosresults", "chaosschedules"]
    verbs: ["create", "list", "get", "patch", "delete", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: chaos-role-binding
  namespace: #{AGENT_NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: chaos-role
subjects:
  - kind: ServiceAccount
    name: argo-chaos
    namespace: #{AGENT_NAMESPACE}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: event-tracker-sa
  namespace: #{AGENT_NAMESPACE}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: event-tracker-role
  namespace: #{AGENT_NAMESPACE}
rules:
  - apiGroups:
      - eventtracker.litmuschaos.io
    resources:
      - eventtrackerpolicies
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - eventtracker.litmuschaos.io
    resources:
      - eventtrackerpolicies/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - ""
    resources:
      - pods
      - configmaps
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - extensions
      - apps
    resources:
      - deployments
      - daemonsets
      - statefulsets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: event-tracker-role-binding
  namespace: #{AGENT_NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: event-tracker-role
subjects:
  - kind: ServiceAccount
    name: event-tracker-sa
    namespace: #{AGENT_NAMESPACE}
