 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: kaniko

 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: kaniko
 rules:
 - apiGroups: ['extensions']
   resources: ['podsecuritypolicies']
   verbs:     ['use']
   resourceNames:
   - kaniko-psp

 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
   name: kaniko
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: kaniko
 subjects:
 - kind: ServiceAccount
   name: kaniko

 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: cjoc-kaniko-role-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: cjoc-agents
 subjects:
 - kind: ServiceAccount
   name: kaniko
