{{- if .Values.deployKF.argoWorkflows.enabled }}
{{- /* create ClusterRoles for argo-server user access */ -}}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argo-server-user-profile-object-store-secret
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
rules:
  ## NOTE: this rule allows argo-server user ServiceAccounts to use the object store Secret in profile namespaces
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - {{ .Values.deployKF_helpers.kubeflow.pipelines.object_store.profile.cloned_secret_name | quote }}
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argo-server-user-edit
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
aggregationRule:
  clusterRoleSelectors:
    - matchLabels:
        rbac.authorization.kubeflow.org/aggregate-to-argo-server-edit: "true"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argo-server-user-view
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" . }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" . }}
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/managed-by: {{ .Release.Service }}
aggregationRule:
  clusterRoleSelectors:
    - matchLabels:
        rbac.authorization.kubeflow.org/aggregate-to-argo-server-view: "true"

{{- /* --------------- */ -}}
{{- /* loop over users */ -}}
{{- /* --------------- */ -}}
{{- range $user_id, $profiles_access_mapping := .Values.deployKF_helpers.deploykf_profiles.users_profiles_access_mapping }}
{{- $user := get $.Values.deployKF_helpers.deploykf_profiles.users_id_mapping $user_id }}
---
{{- /* create ServiceAccount for this user in the argo-server namespace */ -}}
{{- /* https://argoproj.github.io/argo-workflows/argo-server-sso/#sso-rbac */ -}}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argo-server-user-{{ $user.email | sha256sum }}
  namespace: {{ $.Values.deployKF.argoWorkflows.namespace | quote }}
  annotations:
    workflows.argoproj.io/rbac-rule: {{ printf "email == %q" $user.email | quote }}
    workflows.argoproj.io/rbac-rule-precedence: "1"
    workflows.argoproj.io/service-account-token.name: argo-server-user-{{ $user.email | sha256sum }}-sa-token
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" $ }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" $ }}
    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
---
{{- /* create SA token Secret for this user in the argo-server namespace */ -}}
{{- /* https://argoproj.github.io/argo-workflows/manually-create-secrets/ */ -}}
apiVersion: v1
kind: Secret
metadata:
  name: argo-server-user-{{ $user.email | sha256sum }}-sa-token
  namespace: {{ $.Values.deployKF.argoWorkflows.namespace | quote }}
  annotations:
    kubernetes.io/service-account.name: argo-server-user-{{ $user.email | sha256sum }}
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" $ }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" $ }}
    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
type: kubernetes.io/service-account-token
{{- end }}

{{- /* ------------------ */ -}}
{{- /* loop over profiles */ -}}
{{- /* ------------------ */ -}}
{{- range $profile_name, $users_access_mapping := .Values.deployKF_helpers.deploykf_profiles.profiles_users_access_mapping }}
---
{{- /* create RoleBinding for access to the object store secret in this profile namespace */ -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-server-user-profile-object-store-secret
  namespace: {{ $profile_name | quote }}
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" $ }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" $ }}
    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-server-user-profile-object-store-secret
subjects:
  {{- range $user_id, $user_access := $users_access_mapping }}
  {{- $user := get $.Values.deployKF_helpers.deploykf_profiles.users_id_mapping $user_id }}
  - kind: ServiceAccount
    name: argo-server-user-{{ $user.email | sha256sum }}
    namespace: {{ $.Values.deployKF.argoWorkflows.namespace | quote }}
  {{- end }}
---
{{- /* create RoleBinding for "edit" permissions in this profile namespace */ -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-server-user-edit
  namespace: {{ $profile_name | quote }}
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" $ }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" $ }}
    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-server-user-edit
subjects:
  {{- range $user_id, $user_access := $users_access_mapping }}
  {{- $user := get $.Values.deployKF_helpers.deploykf_profiles.users_id_mapping $user_id }}
  {{- if eq $user_access.role "edit" }}
  - kind: ServiceAccount
    name: argo-server-user-{{ $user.email | sha256sum }}
    namespace: {{ $.Values.deployKF.argoWorkflows.namespace | quote }}
  {{- end }}
  {{- end }}
---
{{- /* create RoleBinding for "view" permissions in this profile namespace */ -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argo-server-user-view
  namespace: {{ $profile_name | quote }}
  labels:
    helm.sh/chart: {{ include "deploykf-profiles-generator.labels.chart" $ }}
    app.kubernetes.io/name: {{ include "deploykf-profiles-generator.labels.name" $ }}
    app.kubernetes.io/instance: {{ $.Release.Name }}
    app.kubernetes.io/managed-by: {{ $.Release.Service }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-server-user-view
subjects:
  {{- range $user_id, $user_access := $users_access_mapping }}
  {{- $user := get $.Values.deployKF_helpers.deploykf_profiles.users_id_mapping $user_id }}
  {{- if eq $user_access.role "view" }}
  - kind: ServiceAccount
    name: argo-server-user-{{ $user.email | sha256sum }}
    namespace: {{ $.Values.deployKF.argoWorkflows.namespace | quote }}
  {{- end }}
  {{- end }}
{{- end }}

{{- end }}