# The provider-kubernetes Deployment runs as the ServiceAccount whose name is
# pinned by 01-provider.yaml (DeploymentRuntimeConfig). Bind that
# ServiceAccount to cluster-admin so it can create the ConfigMap and Job the
# Composition asks for. `cluster-admin` is used for lab simplicity; a
# production installation would scope this down.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: provider-kubernetes
  namespace: crossplane-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: provider-kubernetes-cluster-admin
subjects:
  - kind: ServiceAccount
    name: provider-kubernetes
    namespace: crossplane-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
---
# ProviderConfig tells provider-kubernetes to authenticate against the same
# cluster it runs on, using its pinned ServiceAccount.
apiVersion: kubernetes.crossplane.io/v1alpha1
kind: ProviderConfig
metadata:
  name: kubernetes-default
spec:
  credentials:
    source: InjectedIdentity