apiVersion: v1
kind: ServiceAccount
metadata:
  name: plex-deployer
  namespace: plex
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: plex-deployer
  namespace: plex
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["plex-scripts"]
    verbs: ["get", "patch", "update"]
  - apiGroups: [""]
    resources: ["persistentvolumeclaims"]
    resourceNames: ["plex-config"]
    verbs: ["get", "patch", "update"]
  - apiGroups: [""]
    resources: ["services"]
    resourceNames: ["plex"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    resourceNames: ["plex"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["traefik.io"]
    resources: ["ingressroutes"]
    resourceNames: ["plex-brunner-ninja"]
    verbs: ["get", "patch", "update"]
  - apiGroups: ["monitoring.coreos.com"]
    resources: ["servicemonitors", "prometheusrules"]
    resourceNames: ["plex"]
    verbs: ["get", "patch", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: plex-deployer
  namespace: plex
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: plex-deployer
subjects:
  - kind: ServiceAccount
    name: plex-deployer
    namespace: plex
---
apiVersion: v1
kind: Secret
metadata:
  name: plex-deployer-token
  namespace: plex
  annotations:
    kubernetes.io/service-account.name: plex-deployer
type: kubernetes.io/service-account-token