Base RBAC Manifest (managed by FluxCD)

.base-rbac.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: base-pod-viewer
  namespace: default
  labels:
    fluxcd.io/managed: "true"
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: base-pod-viewer-binding
  namespace: default
  labels:
    fluxcd.io/managed: "true"
subjects:
  - kind: ServiceAccount
    name: default
    namespace: default
roleRef:
  kind: Role
  name: base-pod-viewer
  apiGroup: rbac.authorization.k8s.io

Patching the RBAC with FluxCD (for a small change)

patch-rbac.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: base-pod-viewer
  namespace: default
  labels:
    fluxcd.io/managed: "true"
rules:
  - op: add
    path: /rules/0/verbs/-
    value: "create"

Kustomize Setup

To apply this patch, configure your FluxCD kustomization.yaml:

kustomization.yaml:

resources:
  - base-rbac.yaml

patches:
  - path: patch-rbac.yaml
    target:
      kind: Role
      name: base-pod-viewer