<p>I was trying to patch service account to rolebinding but when i ran command for patch, it replaced whole subject field in rolebinding yml. here i show my existing config and command that i executed for expected output</p>
<p>command to patch :</p>
<pre><code>kubectl patch rolebinding test-team-binding  --patch &quot;$(cat patch-file.yml)&quot; 
</code></pre>
<p>patch-file.yml:</p>
<pre><code>subjects:
- kind: ServiceAccount
  name: user3
  namespace: test-namespace
</code></pre>
<p>rolebinding.yml:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: &quot;2020-09-08T11:24:54Z&quot;
  managedFields:
  - apiVersion: rbac.authorization.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:kubectl.kubernetes.io/last-applied-configuration: {}
      f:roleRef:
        f:apiGroup: {}
        f:kind: {}
        f:name: {}
      f:subjects: {}
    manager: kubectl
    operation: Update
    time: &quot;2020-10-06T07:37:58Z&quot;
  name: test-team-binding
  namespace: test-namespace
  resourceVersion: &quot;45697451&quot;
  selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/test-namespace/rolebindings/test-team-binding
  uid: b602b333-4ee8-4601-8c75-f3707bb19d68
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: test-team
subjects:
- kind: ServiceAccount
  name: user1
  namespace: test-namespace
- kind: ServiceAccount
  name: user2
  namespace: test-namespace
</code></pre>
<p>expected output:</p>
<pre><code>subjects:
- kind: ServiceAccount
  name: user1
  namespace: test-namespace
- kind: ServiceAccount
  name: user2
  namespace: test-namespace
- kind: ServiceAccount
  name: user3
  namespace: test-namespace
</code></pre>
<p>result output:</p>
<pre><code>subjects:
- kind: ServiceAccount
  name: user3
  namespace: test-namespace
</code></pre>

Mehdi Fallahi
<p>You can add/replace/remove by specifying the operation in the patch command in json type, by default patch command will replace the value. The below command should work for your requirement.</p>
<pre><code>kubectl patch rolebinding test-team-binding --type=json -p='[{&quot;op&quot;: &quot;add&quot;, &quot;path&quot;: &quot;/subjects/3&quot;, &quot;value&quot;: {&quot;kind&quot;: &quot;ServiceAccount&quot;,&quot;name&quot;:&quot;user3&quot;,&quot;namespace&quot;:&quot;test-namespace&quot; } }]'
</code></pre>
<p>Thanks,
Kiruba</p>
