---
apiVersion: v1
kind: List
items:
- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: create-job
    namespace: cockpit

- kind: Role
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    namespace: cockpit
    name: job-creator
  rules:
    apiGroups: ["", "batch"] # "" indicates the core API group
    resources: ["jobs"]
    verbs: ["create", "list", "delete", "watch"]

- kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    name: job-creator-binding
    namespace: cockpit
  subjects:
  - kind: ServiceAccount
    name: create-job
    namespace: cockpit
  roleRef:
    kind: Role
    name: job-creator
    apiGroup: rbac.authorization.k8s.io

Add service account and role objects for using Jobs
release: Add service account and role objects for using Jobs

Add a restricted "system:serviceaccount:cockpit:create-job" service
account that can only handle Jobs to spawn new pods.

This needs to be run by the cluster administrator.
