apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitea-runner
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-runner-kubernetes-token
  annotations:
    kubernetes.io/service-account.name: gitea-runner
type: kubernetes.io/service-account-token
---
# CI may edit the routes of the auth proxy (the ConfigMap lives in the keycloak namespace here).
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: auth-proxy-routes-manager
  namespace: keycloak
rules:
  - apiGroups: [""]
    resources: [configmaps]
    resourceNames: [auth-proxy-routes]
    verbs: [get, update, patch]
  - apiGroups: [""]
    resources: [configmaps]
    verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gitea-runner-auth-proxy-routes
  namespace: keycloak
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: auth-proxy-routes-manager
subjects:
  - kind: ServiceAccount
    name: gitea-runner
    namespace: gitea