apiVersion: v1
kind: ServiceAccount
metadata:
  name: argocd-deployer
  namespace: argocd
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argocd-deployer
rules:
  - apiGroups: [apiextensions.k8s.io]
    resources: [customresourcedefinitions]
    resourceNames: [applications.argoproj.io, applicationsets.argoproj.io, appprojects.argoproj.io]
    verbs: [get, patch, update]
  - apiGroups: [networking.k8s.io]
    resources: [networkpolicies]
    resourceNames: [argocd-application-controller, argocd-notifications-controller, argocd-repo-server, argocd-server, argocd-dex-server, argocd-redis]
    verbs: [get, patch, update]
  - apiGroups: [""]
    resources: [serviceaccounts]
    resourceNames: [argocd-application-controller, argocd-applicationset-controller, argocd-notifications-controller, argocd-repo-server, argocd-server, argocd-dex-server]
    verbs: [get, patch, update]
  - apiGroups: [""]
    resources: [configmaps]
    resourceNames: [argocd-cm, argocd-cmd-params-cm, argocd-gpg-keys-cm, argocd-notifications-cm, argocd-rbac-cm, argocd-ssh-known-hosts-cm, argocd-tls-certs-cm, argocd-redis-health-configmap]
    verbs: [get, patch, update]
  - apiGroups: [""]
    resources: [services]
    resourceNames: [argocd-applicationset-controller, argocd-repo-server, argocd-server, argocd-dex-server, argocd-redis]
    verbs: [get, patch, update]
  - apiGroups: [apps]
    resources: [deployments]
    resourceNames: [argocd-applicationset-controller, argocd-notifications-controller, argocd-repo-server, argocd-server, argocd-dex-server, argocd-redis]
    verbs: [get, patch, update]
  - apiGroups: [apps]
    resources: [statefulsets]
    resourceNames: [argocd-application-controller]
    verbs: [get, patch, update]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses]
    resourceNames: [argocd-server]
    verbs: [get, patch, update]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [clusterroles]
    resourceNames: [argocd-application-controller, argocd-notifications-controller, argocd-server]
    verbs: [get, patch, update, escalate, bind]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [clusterrolebindings]
    resourceNames: [argocd-application-controller, argocd-notifications-controller, argocd-server]
    verbs: [get, patch, update]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [roles]
    resourceNames: [argocd-application-controller, argocd-applicationset-controller, argocd-notifications-controller, argocd-repo-server, argocd-server, argocd-dex-server]
    verbs: [get, patch, update, escalate, bind]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [rolebindings]
    resourceNames: [argocd-application-controller, argocd-applicationset-controller, argocd-notifications-controller, argocd-repo-server, argocd-server, argocd-dex-server]
    verbs: [get, patch, update]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argocd-deployer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argocd-deployer
subjects:
  - kind: ServiceAccount
    name: argocd-deployer
    namespace: argocd
---
apiVersion: v1
kind: Secret
metadata:
  name: argocd-deployer-token
  namespace: argocd
  annotations:
    kubernetes.io/service-account.name: argocd-deployer
type: kubernetes.io/service-account-token