apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: {{ .Values.secretOverrides.namespace | default .Release.Namespace }}
  name: eks-connector-secret-access
rules:
  - apiGroups: [ "" ]
    resources:
      - secrets
    verbs: [ "get", "update" ]
    resourceNames:
      {{- range $i, $e := until (int .Values.replicaCount) }}
      - {{ $.Values.secretOverrides.prefix | default "eks-connector-state" }}-{{ $i }}
      {{- end}}
  - apiGroups: [ "" ]
    resources:
      - secrets
    verbs: [ "create" ]