---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ dev_access_role_name }}
  namespace: {{ dev_access_namespace }}
rules:
  # Core workload resources — read
  - apiGroups: [""]
    resources:
      - pods
      - services
      - endpoints
      - configmaps
      - persistentvolumeclaims
      - events
      - replicationcontrollers
    verbs: {{ dev_access_verbs | to_json }}
  # Logs — always readable
  - apiGroups: [""]
    resources:
      - pods/log
    verbs: ["get", "list", "watch"]
{% if dev_access_allow_exec | bool %}
  # Exec and port-forward — for debugging
  - apiGroups: [""]
    resources:
      - pods/exec
      - pods/portforward
    verbs: ["create"]
{% endif %}
  # Secrets — read only (developers may need env inspection)
  - apiGroups: [""]
    resources:
      - secrets
    verbs: ["get", "list"]
  # Apps
  - apiGroups: ["apps"]
    resources:
      - deployments
      - replicasets
      - statefulsets
      - daemonsets
    verbs: {{ dev_access_verbs | to_json }}
  # Batch
  - apiGroups: ["batch"]
    resources:
      - jobs
      - cronjobs
    verbs: {{ dev_access_verbs | to_json }}
  # Networking
  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
      - networkpolicies
    verbs: {{ dev_access_verbs | to_json }}
  # Traefik CRDs
  - apiGroups: ["traefik.io"]
    resources:
      - ingressroutes
      - ingressroutetcps
      - middlewares
    verbs: {{ dev_access_verbs | to_json }}