{{- /*
RBAC for the harbor-pg-app-annotator Helm post-install/post-upgrade Job.

The Job needs to:
  1. GET harbor-pg-app (poll until it exists — CNPG bootstraps it 30-60 s
     after the HelmRelease applies on a fresh Sovereign).
  2. PATCH harbor-pg-app to add the reflector.v1.k8s.emberstack.com/
     reflection-allowed + reflection-allowed-namespaces annotations.

Permissions (least-privilege):
  - get/list on the `harbor-pg-app` Secret (poll existence + read current
    annotations before patching).
  - patch on `harbor-pg-app` (add the reflector annotations).

The Role is scoped to the `harbor` namespace — no cluster-wide
permission needed.  Consistent with bp-openbao's auto-unseal-rbac.yaml
pattern.

Skip-render gate: always emits (CNPG annotator is unconditional for
bp-harbor because CNPG is a hard dependency). The Capabilities gate in
cnpg-cluster.yaml ensures Cluster is only rendered when the CRD is
present, so by the time Helm upgrade runs (which triggers this Job) the
CNPG Secret is either present or about to materialise.

Per docs/INVIOLABLE-PRINCIPLES.md #10: no credentials in this template.
*/}}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: harbor-pg-app-annotator
  namespace: {{ .Values.postgres.cluster.namespace | default .Release.Namespace | quote }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    {{- include "bp-harbor.labels" . | nindent 4 }}
    catalyst.openova.io/component: cnpg-app-annotator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: harbor-pg-app-annotator
  namespace: {{ .Values.postgres.cluster.namespace | default .Release.Namespace | quote }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    {{- include "bp-harbor.labels" . | nindent 4 }}
    catalyst.openova.io/component: cnpg-app-annotator
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "patch"]
    resourceNames:
      - {{ printf "%s-app" (.Values.postgres.cluster.name | default "harbor-pg") | quote }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: harbor-pg-app-annotator
  namespace: {{ .Values.postgres.cluster.namespace | default .Release.Namespace | quote }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
    {{- include "bp-harbor.labels" . | nindent 4 }}
    catalyst.openova.io/component: cnpg-app-annotator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: harbor-pg-app-annotator
subjects:
  - kind: ServiceAccount
    name: harbor-pg-app-annotator
    namespace: {{ .Values.postgres.cluster.namespace | default .Release.Namespace | quote }}
