https://www.ianunruh.com/posts/oauth2-proxy-with-k8s-service-accounts/