{{- range $key, $spec := .Values }}
{{- if and (ne $key "global") (ne $key "enabled") }}
{{- if $spec.enabled }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  labels:
    app: {{ template "istio.name" $ }}
    chart: {{ $.Chart.Name }}-{{ $.Chart.Version }}
    heritage: {{ $.Release.Service }}
    release: {{ $.Release.Name }}
  name: {{ $key }}-{{ $.Release.Namespace }}
rules:
- apiGroups: ["extensions"]
  resources: ["thirdpartyresources", "virtualservices", "destinationrules", "gateways"]
  verbs: ["get", "watch", "list", "update"]
---
{{- end }}
{{- end }}
{{- end }}
