# The UI edits the shared `fancy-dns-zones` ConfigMap. Its projected volume is
# read-only; these narrowly scoped permissions let the API update only that
# one ConfigMap so both DNS replicas receive the same records.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: fancy-dns
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
automountServiceAccountToken: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: fancy-dns-zones
  namespace: dns
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    resourceNames: ["fancy-dns-zones"]
    verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: fancy-dns-zones
  namespace: dns
subjects:
  - kind: ServiceAccount
    name: fancy-dns
    namespace: dns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: fancy-dns-zones