kube-tagger.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kube-tagger
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["persistentvolumeclaims", "persistentvolumes"]
  verbs: ["get", "watch", "list"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-tagger
  namespace: kube-system
automountServiceAccountToken: true
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: kube-tagger-binding
subjects:
- kind: ServiceAccount
  name: kube-tagger
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: kube-tagger
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-tagger
  namespace: kube-system
  labels:
    app: kube-tagger
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kube-tagger
  template:
    metadata:
      labels:
        app: kube-tagger
    spec:
      serviceAccountName: kube-tagger
      containers:
      - name: kube-tagger
        image: sergrua/kube-tagger:latest
        command: ["/app/main"]