<p>For example, I change role verbs</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: provisioning-role
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch"]
</code></pre>

<p>and run a Helm <code>upgrade</code>. Should the pods bound to those roles be restarted/replaced? (Those pods may be created manually without Helm.)</p>

<p>No need to recreate the pods. When you create a Role/RoleBinding or ClusterRole/ClusterRoleBinding, the entities automatically get these permissions right away.</p>

<p>One prove used to be Helm itself. When you fresh install Helm, you get this error from Tiller saying has no access to the cluster to do anything, but then you give Tiller <code>cluster-role</code> (or any other with more caution) permissions and it starts working right away.</p>
