kubestacker.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubestacker
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubestacker-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: kubestacker
  namespace: kube-system
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: kubestacker
  name: kubestacker
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: kubestacker
  template:
    metadata:
      labels:
        app: kubestacker
    spec:
      containers:
      - image: busybox
        imagePullPolicy: Always
        name: kubestacker
        command: ["/bin/sleep"]
        args: ["infinity"]
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: false
      restartPolicy: Always
      serviceAccount: kubestacker
      serviceAccountName: kubestacker