Kubernetes RBAC role, service account, and role binding for no access to in-cluster Kubernetes API

rbac-noaccess.ts

import * as k8s from "@kubernetes/client-node";
import { DeepPartial } from "ts-essentials";
const serviceAccount: DeepPartial<k8s.V1ServiceAccount> = {
    apiVersion: "v1",
    kind: "ServiceAccount",
    metadata: {
        name: "noaccess",
    },
};
const role: DeepPartial<k8s.V1Role> = {
    apiVersion: "rbac.authorization.k8s.io/v1beta1",
    kind: "Role",
    metadata: {
        name: "noaccess",
    },
    rules: [],
};
const roleBinding: DeepPartial<k8s.V1RoleBinding> = {
    apiVersion: "rbac.authorization.k8s.io/v1beta1",
    kind: "RoleBinding",
    metadata: {
        name: "noaccess",
    },
    roleRef: {
        apiGroup: "rbac.authorization.k8s.io",
        kind: "Role",
        name: "noaccess",
    },
    subjects: [
        {
            kind: "ServiceAccount",
            name: "noaccess",
        },
    ],
};

Thanks @ddgenome. I assume I have to apply top down.