Give a ServiceAccount Read-Only Access

A dashboard running inside the search namespace needs to follow the rollout of the team's workloads. It must authenticate with its own identity and should be able to look at Pods and Deployments, but the security team insists it gets nothing beyond that.

Task

• A ServiceAccount named scheduler-ui-watcher exists in namespace search.
• scheduler-ui-watcher can get, list and watch Pods in search.
• scheduler-ui-watcher can get, list and watch Deployments in search.
• scheduler-ui-watcher cannot delete Pods, cannot read Secrets, and has no access to Pods in any other namespace (for example checkout).
• Leave the existing Role pod-janitor in search unchanged.

A practice cluster is running on this machine: start with kubectl get serviceaccounts,roles,rolebindings -n search.