From 799e277fe0df436501abcc29f8aed7a7a4da0bf0 Mon Sep 17 00:00:00 2001
From: Joao Gilberto Magalhaes <joao@byjg.com.br>
Date: Fri, 26 Aug 2022 14:07:47 -0500
Subject: [PATCH] Add service account and RBAC

---
 Dockerfile                          |  1 +
 examples/kubernetes/easyhaproxy.yml | 84 +++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index fb29e07..c252af6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,6 +3,7 @@ FROM alpine:3.16
 ARG RELEASE_VERSION_ARG
 
 ENV RELEASE_VERSION=$RELEASE_VERSION_ARG
+ENV TZ="Etc/UTC"
 
 WORKDIR /scripts
 
diff --git a/examples/kubernetes/easyhaproxy.yml b/examples/kubernetes/easyhaproxy.yml
index 3a7270a..1f54f2e 100644
--- a/examples/kubernetes/easyhaproxy.yml
+++ b/examples/kubernetes/easyhaproxy.yml
@@ -4,6 +4,89 @@ kind: Namespace
 metadata:
   name: easyhaproxy
 
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: easyhaproxy-ingress
+  namespace: easyhaproxy
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: easyhaproxy-ingress
+rules:
+- apiGroups:
+  - ""
+  resources:
+  # - configmaps
+  # - endpoints
+  # - nodes
+  - pods
+  - services
+  - namespaces
+  # - events
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - "extensions"
+  - "networking.k8s.io"
+  resources:
+  - ingresses
+  # - ingresses/status
+  # - ingressclasses
+  verbs:
+  - get
+  - list
+  - watch
+# - apiGroups:
+#   - "extensions"
+#   - "networking.k8s.io"
+#   resources:
+#   - ingresses/status
+#   verbs:
+#   - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  # - watch
+  # - create
+  # - patch
+  # - update
+# - apiGroups:
+#   - "discovery.k8s.io"
+#   resources:
+#   - endpointslices
+#   verbs:
+#   - get
+#   - list
+#   - watch
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: easyhaproxy-ingress
+  namespace: easyhaproxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: easyhaproxy-ingress
+subjects:
+- kind: ServiceAccount
+  name: easyhaproxy-ingress
+  namespace: easyhaproxy
+
+
 ---
 apiVersion: apps/v1
 kind: DaemonSet
@@ -19,6 +102,7 @@ spec:
       labels:
         app: easyhaproxy-ingress
     spec:
+      serviceAccountName: easyhaproxy-ingress
       containers:
       - image: byjg/easy-haproxy:test
         imagePullPolicy: Always