apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubetail-cli
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: kubetail-cli
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubetail-cli-cluster
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubetail-cli-cluster
subjects:
  - kind: ServiceAccount
    name: kubetail-cli
    namespace: default
roleRef:
  kind: ClusterRole
  name: kubetail-cli-cluster
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: kubetail-cli
  namespace: default
subjects:
  - kind: ServiceAccount
    name: kubetail-cli
    namespace: default
roleRef:
  kind: Role
  name: kubetail-cli
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Pod
metadata:
  name: kubetail-cli
  namespace: default
spec:
  serviceAccountName: kubetail-cli
  containers:
    - name: kubetail-cli
      image: kubetail/kubetail-cli
      command: ["sh", "-c", "sleep infinity"]
  restartPolicy: Never