apiVersion: v1
kind: ServiceAccount
metadata: {name: authentik-deployer, namespace: authentik}
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata: {name: authentik-deployer}
rules:
  - apiGroups: [networking.k8s.io]
    resources: [networkpolicies]
    resourceNames: [authentik-postgresql]
    verbs: [get, patch, update]
  - apiGroups: [policy]
    resources: [poddisruptionbudgets]
    resourceNames: [authentik-postgresql]
    verbs: [get, patch, update]
  - apiGroups: [""]
    resources: [serviceaccounts]
    resourceNames: [authentik, authentik-postgresql]
    verbs: [get, patch, update]
  - apiGroups: [""]
    resources: [configmaps]
    resourceNames: [authentik-postgresql-configuration, authentik-postgresql-extended-configuration, authentik-client-credentials-event-filter, authentik-blueprints]
    verbs: [get, patch, update]
  - apiGroups: [""]
    resources: [services]
    resourceNames: [authentik-postgresql-hl, authentik-postgresql, authentik-server]
    verbs: [get, patch, update]
  - apiGroups: [apps]
    resources: [deployments]
    resourceNames: [authentik-server, authentik-worker]
    verbs: [get, patch, update]
  - apiGroups: [apps]
    resources: [statefulsets]
    resourceNames: [authentik-postgresql]
    verbs: [get, patch, update]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses]
    resourceNames: [authentik-server, authentik-outpost-path]
    verbs: [get, patch, update]
  - apiGroups: [traefik.io]
    resources: [ingressroutes]
    resourceNames: [authentik-media-redirect]
    verbs: [get, patch, update]
  - apiGroups: [traefik.io]
    resources: [middlewares]
    resourceNames: [media-strip-prefix]
    verbs: [get, patch, update]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [clusterroles]
    resourceNames: [authentik-authentik]
    verbs: [get, patch, update, escalate, bind]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [clusterrolebindings]
    resourceNames: [authentik-authentik]
    verbs: [get, patch, update]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [roles]
    resourceNames: [authentik]
    verbs: [get, patch, update, escalate, bind]
  - apiGroups: [rbac.authorization.k8s.io]
    resources: [rolebindings]
    resourceNames: [authentik]
    verbs: [get, patch, update]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata: {name: authentik-deployer}
roleRef: {apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: authentik-deployer}
subjects: [{kind: ServiceAccount, name: authentik-deployer, namespace: authentik}]
---
apiVersion: v1
kind: Secret
metadata:
  name: authentik-deployer-token
  namespace: authentik
  annotations: {kubernetes.io/service-account.name: authentik-deployer}
type: kubernetes.io/service-account-token