问在库伯奈特问题上，有哪些医生需要获得什么权利才能做一件事？

EN

---
# Create namespace
apiVersion: v1
kind: Namespace
metadata:
  name: devops-tools
---
# Create Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: devops-tools
  name: bino

---
# Set Secrets for SA
# k8s >= 1.24 need to manualy created
# https://stackoverflow.com/a/72258300
apiVersion: v1
kind: Secret
metadata:
  name: bino-token
  namespace: devops-tools
  annotations:
    kubernetes.io/service-account.name: bino
type: kubernetes.io/service-account-token

---
# Create Cluster Role
# Beware !!! This is Cluster wide FULL RIGHTS
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-tools-role
  namespace: devops-tools
rules:
  - apiGroups:
        - ""
        - apps
        - autoscaling
        - batch
        - extensions
        - policy
        - networking.k8s.io
        - rbac.authorization.k8s.io
    resources:
      - pods
      - componentstatuses
      - configmaps
      - daemonsets
      - deployments
      - events
      - endpoints
      - horizontalpodautoscalers
      - ingress
      - jobs
      - limitranges
      - namespaces
      - nodes
      - pods
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
# Bind the SA to Cluster Role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: devops-tools-role-binding
subjects:
- namespace: devops-tools
  kind: ServiceAccount
  name: bino
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: devops-tools-role
---

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: devops-tools-role-binding-admin
subjects:
- namespace: devops-tools
  kind: ServiceAccount
  name: bino
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin