apiVersion: v1
kind: ServiceAccount
metadata: {name: tunnel, namespace: short}
automountServiceAccountToken: false
---
apiVersion: coordination.k8s.io/v1
kind: Lease
metadata: {name: tunnel, namespace: short}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: tunnel, namespace: short}
rules:
  - apiGroups: [coordination.k8s.io]
    resources: [leases]
    resourceNames: [tunnel]
    verbs: [get, update]
  - apiGroups: [""]
    resources: [pods]
    verbs: [list, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: {name: tunnel, namespace: short}
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: Role, name: tunnel}
subjects: [{kind: ServiceAccount, name: tunnel, namespace: short}]