apiVersion: apps/v1
kind: Deployment
metadata:
  name: servicex
  labels:
    app: servicex
spec:
  selector:
    matchLabels:
      app: servicex
  replicas: 1
  template:
    metadata:
      labels:
        app: servicex
    spec:
      serviceAccountName: kubectl-sa
      containers:
      - name: servicex
        image: gravitl/servicex:latest
        command: ['bash', '-c', "while true; do /app/app; sleep $SLEEP; done"]
        env:
        - name: SLEEP
          value: "60"
        - name: NETWORK
          value: "XXXX"
        - name: SECRET
          value: "YYYY"
        - name: SERVER_API_URL
          value: "ZZZZ"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubectl-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pods-and-services
rules:
  - apiGroups: [""]
    resources:
      - pods
      - services
    verbs:
      - get
      - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pods-and-services-sa
subjects:
  - kind: ServiceAccount
    name: internal-kubectl
roleRef:
  kind: Role
  name: pods-and-services
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubectl-access
rules:
  - apiGroups: [""]
    resources:
      - pods
      - services
    verbs:
      - get
      - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubectl-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kubectl-access
subjects:
- kind: ServiceAccount
  name: kubectl-sa
  namespace: default