ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/tunnel/rbac.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata: {name: tunnel, namespace: short}
+automountServiceAccountToken: false
+---
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata: {name: tunnel, namespace: short}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata: {name: tunnel, namespace: short}
+rules:
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    resourceNames: [tunnel]
+    verbs: [get, update]
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [list, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata: {name: tunnel, namespace: short}
+roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: tunnel}
+subjects: [{kind: ServiceAccount, name: tunnel, namespace: short}]