{{- if .Values.rbac.create -}}
{{- if .Values.topology.enabled }}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ include "ceph-csi-rbd.nodeplugin.fullname" . }}
  labels:
    app: {{ include "ceph-csi-rbd.name" . }}
    chart: {{ include "ceph-csi-rbd.chart" . }}
    component: {{ .Values.nodeplugin.name }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
subjects:
  - kind: ServiceAccount
    name: {{ include "ceph-csi-rbd.serviceAccountName.nodeplugin" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ include "ceph-csi-rbd.nodeplugin.fullname" . }}
  apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- end -}}

{{- if .Values.rbac.create -}}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: {{ include "ceph-csi-rbd.nodeplugin.fullname" . }}
  labels:
    app: {{ include "ceph-csi-rbd.name" . }}
    chart: {{ include "ceph-csi-rbd.chart" . }}
    component: {{ .Values.nodeplugin.name }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
subjects:
  - kind: ServiceAccount
    name: {{ include "ceph-csi-rbd.serviceAccountName.nodeplugin" . }}
    namespace: {{ .Release.Namespace }}
roleRef:
  kind: ClusterRole
  name: {{ include "ceph-csi-rbd.nodeplugin.fullname" . }}
  apiGroup: rbac.authorization.k8s.io
{{- end -}}

Fix missing ClusterRoleBinding for nodeplugin ServiceAccount
helm: Fix missing ClusterRoleBinding for nodeplugin ServiceAccount

When topology is disabled, the ClusterRoleBinding is not created in the Helm
chart. However, the nodeplugin needs access to volumeattachments for the volume
healer.

Signed-off-by: Steven Reitsma <4068f0880b399410602d694b3cc711c8a8f4727e@properchaos.nl>
