{{- if .Values.rbac.enabled }}
kind: ClusterRole
apiVersion: "{{ .Values.rbac.apiVersion }}"
metadata:
  name: "{{ .Release.Name }}-role"
rules:
  - apiGroups: ["", "extensions", "storage.k8s.io"]
    verbs: ["get", "list"]
    resources:
      - namespaces
      - pods
      - replicasets
      - deployments
      - replicationcontrollers
      - nodes
      - services
      - componentstatuses
      - storageclasses
---
kind: ClusterRoleBinding
apiVersion: "{{ .Values.rbac.apiVersion }}"
metadata:
  name: "{{ .Release.Name }}-role-binding"
subjects:
  - kind: ServiceAccount
    name: default
    namespace: "{{ .Release.Namespace }}"
roleRef:
  kind: ClusterRole
  name: "{{ .Release.Name }}-role"
  apiGroup: rbac.authorization.k8s.io
{{- end }}

{{- if .Values.rbac.enabled }}
kind: ClusterRole
apiVersion: "{{ .Values.rbac.apiVersion }}"
metadata:
  name: "{{ .Release.Name }}-role"
rules:
  - apiGroups: ["", "extensions", "storage.k8s.io"]
    verbs: ["get", "list"]
    resources:
      - namespaces
      - pods
      - replicasets
      - deployments
      - replicationcontrollers
      - nodes
      - services
      - componentstatuses
      - storageclasses
  - apiGroups: ["", "batch", "extensions", "storage.k8s.io"]
    verbs: ["get", "list", "delete"]
    resources:
      - jobs
      - pods
---
kind: ClusterRoleBinding
apiVersion: "{{ .Values.rbac.apiVersion }}"
metadata:
  name: "{{ .Release.Name }}-role-binding"
subjects:
  - kind: ServiceAccount
    name: default
    namespace: "{{ .Release.Namespace }}"
roleRef:
  kind: ClusterRole
  name: "{{ .Release.Name }}-role"
  apiGroup: rbac.authorization.k8s.io
{{- end }}

Add acl for cleanup job
Add acl for cleanup job

cleanup job needs to be able to delete pods and jobs
