// Copyright (c) 2023 Volvo Car Corporation
// SPDX-License-Identifier: Apache-2.0

// Code generated by lingon. EDIT AS MUCH AS YOU LIKE.

package certmanager

import (
	ku "github.com/golingon/lingon/pkg/kubeutil"
	"github.com/golingon/lingoneks/meta"
	rbacv1 "k8s.io/api/rbac/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

var LeaderElectionRole = &rbacv1.Role{
	TypeMeta: ku.TypeRoleV1,
	ObjectMeta: metav1.ObjectMeta{
		Labels:    CM.Controller.Labels(),
		Name:      CM.Controller.Name + ":leaderelection",
		Namespace: ku.NSKubeSystem,
	},
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups:     []string{"coordination.k8s.io"},
			ResourceNames: []string{"cert-manager-controller"},
			Resources:     []string{"leases"},
			Verbs:         []string{"get", "update", "patch"},
		}, {
			APIGroups: []string{"coordination.k8s.io"},
			Resources: []string{"leases"},
			Verbs:     []string{"create"},
		},
	},
}

var LeaderElectionRB = ku.BindRole(
	LeaderElectionRole.Name,
	CM.ControllerSA,
	LeaderElectionRole,
	CM.Controller.Labels(),
)

// var LeaderElectionRB = &rbacv1.RoleBinding{
// 	ObjectMeta: metav1.ObjectMeta{
// 		Labels: map[string]string{
// 			"app":                          "cert-manager",
// 			"app.kubernetes.io/component":  "controller",
// 			"app.kubernetes.io/instance":   "cert-manager",
// 			"app.kubernetes.io/managed-by": "Helm",
// 			"app.kubernetes.io/name":       "cert-manager",
// 			"app.kubernetes.io/version":    "v1.12.2",
// 			"helm.sh/chart":                "cert-manager-v1.12.2",
// 		},
// 		Name:      "cert-manager:leaderelection",
// 		Namespace: "kube-system",
// 	},
// 	RoleRef: rbacv1.RoleRef{
// 		APIGroup: "rbac.authorization.k8s.io",
// 		Kind:     "Role",
// 		Name:     "cert-manager:leaderelection",
// 	},
// 	Subjects: []rbacv1.Subject{
// 		{
// 			Kind:      "ServiceAccount",
// 			Name:      "cert-manager",
// 			Namespace: "cert-manager",
// 		},
// 	},
// 	TypeMeta: metav1.TypeMeta{
// 		APIVersion: "rbac.authorization.k8s.io/v1",
// 		Kind:       "RoleBinding",
// 	},
// }

var ControllerApproveIoCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-approve:cert-manager-io"),
	// ObjectMeta: metav1.ObjectMeta{
	// Labels: map[string]string{
	// 	"app":                          "cert-manager",
	// 	"app.kubernetes.io/component":  "cert-manager",
	// 	"app.kubernetes.io/instance":   "cert-manager",
	// 	"app.kubernetes.io/managed-by": "Helm",
	// 	"app.kubernetes.io/name":       "cert-manager",
	// 	"app.kubernetes.io/version":    "v1.12.2",
	// 	"helm.sh/chart":                "cert-manager-v1.12.2",
	// },
	// Name: "cert-manager-controller-approve:cert-manager-io",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			ResourceNames: []string{
				"issuers.cert-manager.io/*",
				"clusterissuers.cert-manager.io/*",
			},
			Resources: []string{"signers"},
			Verbs:     []string{"approve"},
		},
	},
}

var ControllerCertificatesCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-certificates"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "controller",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-certificates",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{
				"certificates",
				"certificates/status",
				"certificaterequests",
				"certificaterequests/status",
			},
			Verbs: []string{"update", "patch"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{
				"certificates",
				"certificaterequests",
				"clusterissuers",
				"issuers",
			},
			Verbs: []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{
				"certificates/finalizers",
				"certificaterequests/finalizers",
			},
			Verbs: []string{"update"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders"},
			Verbs:     []string{"create", "delete", "get", "list", "watch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"secrets"},
			Verbs: []string{
				"get",
				"list",
				"watch",
				"create",
				"update",
				"delete",
				"patch",
			},
		}, {
			APIGroups: []string{""},
			Resources: []string{"events"},
			Verbs:     []string{"create", "patch"},
		},
	},
}

var ControllerCertificateSigningRequestsCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-certificatesigningrequests"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "cert-manager",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-certificatesigningrequests",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"certificates.k8s.io"},
			Resources: []string{"certificatesigningrequests"},
			Verbs:     []string{"get", "list", "watch", "update"},
		}, {
			APIGroups: []string{"certificates.k8s.io"},
			Resources: []string{"certificatesigningrequests/status"},
			Verbs:     []string{"update", "patch"},
		}, {
			APIGroups: []string{"certificates.k8s.io"},
			ResourceNames: []string{
				"issuers.cert-manager.io/*",
				"clusterissuers.cert-manager.io/*",
			},
			Resources: []string{"signers"},
			Verbs:     []string{"sign"},
		}, {
			APIGroups: []string{"authorization.k8s.io"},
			Resources: []string{"subjectaccessreviews"},
			Verbs:     []string{"create"},
		},
	},
}

var ControllerChallengesCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-challenges"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "controller",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-challenges",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges", "challenges/status"},
			Verbs:     []string{"update", "patch"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"issuers", "clusterissuers"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"secrets"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"events"},
			Verbs:     []string{"create", "patch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"pods", "services"},
			Verbs:     []string{"get", "list", "watch", "create", "delete"},
		}, {
			APIGroups: []string{"networking.k8s.io"},
			Resources: []string{"ingresses"},
			Verbs: []string{
				"get",
				"list",
				"watch",
				"create",
				"delete",
				"update",
			},
		}, {
			APIGroups: []string{"gateway.networking.k8s.io"},
			Resources: []string{"httproutes"},
			Verbs: []string{
				"get",
				"list",
				"watch",
				"create",
				"delete",
				"update",
			},
		}, {
			APIGroups: []string{"route.openshift.io"},
			Resources: []string{"routes/custom-host"},
			Verbs:     []string{"create"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges/finalizers"},
			Verbs:     []string{"update"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"secrets"},
			Verbs:     []string{"get", "list", "watch"},
		},
	},
}

var ControllerClusterIssuersCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-clusterissuers"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "controller",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-clusterissuers",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers", "clusterissuers/status"},
			Verbs:     []string{"update", "patch"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"secrets"},
			Verbs: []string{
				"get",
				"list",
				"watch",
				"create",
				"update",
				"delete",
			},
		}, {
			APIGroups: []string{""},
			Resources: []string{"events"},
			Verbs:     []string{"create", "patch"},
		},
	},
}

var ControllerIngressShimCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-ingress-shim"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "controller",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-ingress-shim",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificaterequests"},
			Verbs:     []string{"create", "update", "delete"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{
				"certificates",
				"certificaterequests",
				"issuers",
				"clusterissuers",
			},
			Verbs: []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"networking.k8s.io"},
			Resources: []string{"ingresses"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"networking.k8s.io"},
			Resources: []string{"ingresses/finalizers"},
			Verbs:     []string{"update"},
		}, {
			APIGroups: []string{"gateway.networking.k8s.io"},
			Resources: []string{"gateways", "httproutes"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"gateway.networking.k8s.io"},
			Resources: []string{"gateways/finalizers", "httproutes/finalizers"},
			Verbs:     []string{"update"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"events"},
			Verbs:     []string{"create", "patch"},
		},
	},
}

var ControllerIssuersCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-issuers"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "controller",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-issuers",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"issuers", "issuers/status"},
			Verbs:     []string{"update", "patch"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"issuers"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"secrets"},
			Verbs: []string{
				"get",
				"list",
				"watch",
				"create",
				"update",
				"delete",
			},
		}, {
			APIGroups: []string{""},
			Resources: []string{"events"},
			Verbs:     []string{"create", "patch"},
		},
	},
}

var ControllerOrdersCR = &rbacv1.ClusterRole{
	TypeMeta:   ku.TypeClusterRoleV1,
	ObjectMeta: CM.Controller.ObjectMetaNameSuffixNoNS("controller-orders"),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                          "cert-manager",
	// 		"app.kubernetes.io/component":  "controller",
	// 		"app.kubernetes.io/instance":   "cert-manager",
	// 		"app.kubernetes.io/managed-by": "Helm",
	// 		"app.kubernetes.io/name":       "cert-manager",
	// 		"app.kubernetes.io/version":    "v1.12.2",
	// 		"helm.sh/chart":                "cert-manager-v1.12.2",
	// 	},
	// 	Name: "cert-manager-controller-orders",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders", "orders/status"},
			Verbs:     []string{"update", "patch"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders", "challenges"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers", "issuers"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges"},
			Verbs:     []string{"create", "delete"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders/finalizers"},
			Verbs:     []string{"update"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"secrets"},
			Verbs:     []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{""},
			Resources: []string{"events"},
			Verbs:     []string{"create", "patch"},
		},
	},
}

var EditCR = &rbacv1.ClusterRole{
	TypeMeta: ku.TypeClusterRoleV1,
	ObjectMeta: meta.PatchLabelsMap(
		CM.Controller.ObjectMetaNameSuffixNoNS("edit"),
		map[string]string{
			ku.LabelRbacAggregateToAdmin: "true",
			ku.LabelRbacAggregateToEdit:  "true",
		},
	),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                                          "cert-manager",
	// 		"app.kubernetes.io/component":                  "controller",
	// 		"app.kubernetes.io/instance":                   "cert-manager",
	// 		"app.kubernetes.io/managed-by":                 "Helm",
	// 		"app.kubernetes.io/name":                       "cert-manager",
	// 		"app.kubernetes.io/version":                    "v1.12.2",
	// 		"helm.sh/chart":                                "cert-manager-v1.12.2",
	// 		"rbac.authorization.k8s.io/aggregate-to-admin": "true",
	// 		"rbac.authorization.k8s.io/aggregate-to-edit":  "true",
	// 	},
	// 	Name: "cert-manager-edit",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{
				"certificates",
				"certificaterequests",
				"issuers",
			},
			Verbs: []string{
				"create",
				"delete",
				"deletecollection",
				"patch",
				"update",
			},
		}, {
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates/status"},
			Verbs:     []string{"update"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges", "orders"},
			Verbs: []string{
				"create",
				"delete",
				"deletecollection",
				"patch",
				"update",
			},
		},
	},
}

var ViewCR = &rbacv1.ClusterRole{
	TypeMeta: ku.TypeClusterRoleV1,
	ObjectMeta: meta.PatchLabelsMap(
		CM.Controller.ObjectMetaNameSuffixNoNS("view"),
		map[string]string{
			ku.LabelRbacAggregateToAdmin: "true",
			ku.LabelRbacAggregateToView:  "true",
			ku.LabelRbacAggregateToEdit:  "true",
		},
	),
	// ObjectMeta: metav1.ObjectMeta{
	// 	Labels: map[string]string{
	// 		"app":                                          "cert-manager",
	// 		"app.kubernetes.io/component":                  "controller",
	// 		"app.kubernetes.io/instance":                   "cert-manager",
	// 		"app.kubernetes.io/managed-by":                 "Helm",
	// 		"app.kubernetes.io/name":                       "cert-manager",
	// 		"app.kubernetes.io/version":                    "v1.12.2",
	// 		"helm.sh/chart":                                "cert-manager-v1.12.2",
	// 		"rbac.authorization.k8s.io/aggregate-to-admin": "true",
	// 		"rbac.authorization.k8s.io/aggregate-to-edit":  "true",
	// 		"rbac.authorization.k8s.io/aggregate-to-view":  "true",
	// 	},
	// 	Name: "cert-manager-view",
	// },
	Rules: []rbacv1.PolicyRule{
		{
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{
				"certificates",
				"certificaterequests",
				"issuers",
			},
			Verbs: []string{"get", "list", "watch"},
		}, {
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges", "orders"},
			Verbs:     []string{"get", "list", "watch"},
		},
	},
}
