service-account-default-2.tf

resource "kubernetes_role" "non_privileged" {
  metadata {
    name      = "non-privileged-cr"
    namespace = kubernetes_namespace.playground.id
  }

  rule {
    api_groups = [""]
    resources  = ["secrets"]
    verbs      = [""]
  }
  rule {
    api_groups = [""]
    resources  = ["pods"]
    verbs      = ["get", "list", "watch"]
  }
}

resource "kubernetes_role_binding" "non_privileged" {
  metadata {
    name      = "non-privileged-rb"
    namespace = kubernetes_namespace.playground.metadata[0].name
  }

  role_ref {
    kind      = "Role"
    name      = kubernetes_role.non_privileged.metadata[0].name
    api_group = "rbac.authorization.k8s.io"
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.non_privileged.metadata[0].name
    namespace = kubernetes_namespace.playground.metadata[0].name
  }
}