apiVersion: v1
kind: ServiceAccount
metadata:
  name: coredns-config-deployer
  namespace: kube-system
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: coredns-config-deployer
  namespace: kube-system
rules:
  - apiGroups: [apps]
    resources: [deployments]
    resourceNames: [coredns]
    verbs: [get, patch, update]
  - apiGroups: [policy]
    resources: [poddisruptionbudgets]
    resourceNames: [coredns]
    verbs: [get, patch, update]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: coredns-config-deployer
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: coredns-config-deployer
subjects:
  - kind: ServiceAccount
    name: coredns-config-deployer
    namespace: kube-system
---
apiVersion: v1
kind: Secret
metadata:
  name: coredns-config-deployer-token
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: coredns-config-deployer
type: kubernetes.io/service-account-token