suite: ClusterRole
templates:
  - clusterrole.yaml
tests:
  - it: creates a ClusterRole
    asserts:
      - hasDocuments:
          count: 1
      - isKind:
          of: ClusterRole
      - matchSnapshot: {}
  
  - it: sets ClusterRole labels when specified
    values:
      - ../.lint/extra-labels.yaml
    asserts:
      - equal:
          path: metadata.labels.app\.kubernetes\.io/name
          value: teleport-kube-agent
      - equal:
          path: metadata.labels.resource
          value: clusterrole
      - matchSnapshot: {}

  - it: adds services listing permission if discovery is enabled
    set:
      roles: kube,discovery
    asserts:
      - hasDocuments:
          count: 1
      - isKind:
          of: ClusterRole
      - matchSnapshot: {}

  - it: does not add services listing permission if discovery is disabled
    set:
      roles: kube
    asserts:
      - hasDocuments:
          count: 1
      - isKind:
          of: ClusterRole
      - matchSnapshot: {}