{{/*
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}

{{- if and (.Values.manifests.object_bucket_claim) (.Values.conf.elasticsearch.snapshots.enabled) }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: elasticsearch-dependencies-objectbucket
  namespace: {{ .Release.Namespace }}
rules:
  - apiGroups:
      - "objectbucket.io"
    verbs:
      - get
      - list
    resources:
      - objectbuckets
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: elasticsearch-dependencies-objectbucket
  namespace: {{ .Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: elasticsearch-dependencies-objectbucket
subjects:
  - kind: ServiceAccount
    name: create-elasticsearch-templates
    namespace: {{ .Release.Namespace }}
  - kind: ServiceAccount
    name: verify-repositories
    namespace: {{ .Release.Namespace }}

{{- range $bucket := .Values.storage.s3.buckets }}
# When using this Rook CRD, not only bucket will be created,
# but also a secret containing the credentials to access the bucket.
---
apiVersion: objectbucket.io/v1alpha1
kind: ObjectBucketClaim
metadata:
  name: {{ $bucket.name }}
spec:
  bucketName: {{ $bucket.name }}
  storageClassName: {{ $bucket.storage_class }}
...
{{- end -}}
{{- end -}}
