ansible-deployer.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ansible-deployer-account
  namespace: funstuff
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ansible-deployer
rules:
  # Core API
  - apiGroups: ['']
    resources: ['services', 'pods', 'deployments', 'configmaps', 'secrets']
    verbs: ['get', 'list', 'create', 'update', 'delete', 'patch', 'watch']
  # Apps API
  - apiGroups: ['apps']
    resources: ['deployments', 'daemonsets', 'jobs']
    verbs: ['get', 'list', 'create', 'update', 'delete', 'patch', 'watch']
  # Knative API
  - apiGroups: ['serving.knative.dev']
    resources: ['services', 'revisions', 'routes']
    verbs: ['get', 'list', 'create', 'update', 'delete', 'patch', 'watch']
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: ansible-deployer-binding
subjects:
  - kind: ServiceAccount
    name: ansible-deployer-account
    namespace: funstuff
roleRef:
  kind: ClusterRole
  name: ansible-deployer
  apiGroup: rbac.authorization.k8s.io