example rbac (non-cluster roles)

serviceaccount-role-rolebinding-helm-template

kind: Role
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: {{ template "fullname" . }}
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "watch", "list"]
    nonResourceURLs: []
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: {{ template "fullname" . }}
subjects:
  # The subject is the target service account
  - kind: ServiceAccount
    name: {{ template "fullname" . }}
roleRef:
  # The roleRef specifies the role to give to the
  # service account.
  kind: Role
  name: {{ template "fullname" . }} # Tectonic also provides "readonly", "user", and "admin" cluster roles.
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: {{ template "fullname" . }}

This is a helm template for creating the entirety of needed permissions for an application.