In https://phabricator.wikimedia.org/T364389#10174265, we discussed the need to be able to create a Role/RoleBinding/ServiceAccount granting a specific Deployment the ability to create/delete/list/etc Pods.

Given the lack of permissions for the deploy user to manage Role resources, it was suggested by @JMeybohm that we should

• create a ClusterRole in admin_ng with the associated permissions
• create a ServiceAccount and a RoleBinding, linking the ServiceAccount to the ClusterRole, in the chart

However, the deploy role does not have permissions to manage`RoleBinding` resources as well, making this impossible.

I'm creating this ticket to gather feedback as to whether we should grant the deploy user permission to create/delete RoleBinding (and maybe Role resources as well.