chore: create K8s service account to apply changes (#52)

Author: felix-seifert

kubernetes/docs/namespace.yaml

@@ -2,3 +2,18 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: docs-ns
+---
+# RoleBinding for CI service account
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: svc-gha-kubectl-apply-rolebinding
+  namespace: docs-ns
+subjects:
+  - kind: ServiceAccount
+    name: svc-gha-kubectl-apply
+    namespace: service-account-ns
+roleRef:
+  kind: ClusterRole
+  name: svc-gha-kubectl-apply-clusterrole
+  apiGroup: rbac.authorization.k8s.io

kubernetes/service_accounts/namespace.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: service-account-ns
+---
+# RoleBinding for CI service account
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: svc-gha-kubectl-apply-rolebinding
+  namespace: service-account-ns
+subjects:
+  - kind: ServiceAccount
+    name: svc-gha-kubectl-apply
+    namespace: service-account-ns
+roleRef:
+  kind: ClusterRole
+  name: svc-gha-kubectl-apply-clusterrole
+  apiGroup: rbac.authorization.k8s.io

kubernetes/service_accounts/svc-gha-kubectl-apply.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: svc-gha-kubectl-apply
+  namespace: service-account-ns
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: svc-gha-kubectl-apply-token
+  namespace: service-account-ns
+  annotations:
+    kubernetes.io/service-account.name: "svc-gha-kubectl-apply"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: svc-gha-kubectl-apply-clusterrole
+rules:
+  - apiGroups: [""]
+    resources:
+      - services
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+
+  - apiGroups: ["apps"]
+    resources:
+      - deployments
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+
+  - apiGroups: ["rbac.authorization.k8s.io"]
+    resources:
+      - rolebindings
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch