<p>Update: The reason for patching it to add a role to the rolebinding</p>

<p>Is it possible to add/patch to an existing cluster/rolebinding.</p>

<p>To save on obfuscation, I am thinking it would be nice to be able to add to an existing rolebinding.</p>

<p>Adding/patch to a role - I see as a a no go, but for rolebinding - yes please :-)</p>

<p>Tried <a href="https://kubernetes.io/docs/tasks/run-application/update-api-object-kubectl-patch/#use-a-strategic-merge-patch-to-update-a-deployment" rel="nofollow noreferrer">this</a> but no success - so if possible, how to?</p>

<pre><code>subjects:
- kind: ServiceAccount
  name: test-service-account # Name is case sensitive
  apiGroup: ""
  namespace: default
  # core/v1 .. rbac.authorization.k8s.io
roleRef:
  kind: Role #this must be Role or ClusterRole
  name: pod-reader-2add # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>And patched:</p>

<pre><code>kubectl patch rolebinding read-pods --patch "$(cat rolebinding2patch.yaml)"
The RoleBinding "read-pods" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"Role", Name:"pod-reader-2add"}: cannot change roleRef
</code></pre>

Chris G.
<p>You can patch rolebindings. </p>

<pre><code>$ cat patch.yaml
subjects:
- kind: ServiceAccount
  name: my-new-service-account
  namespace: default
</code></pre>

<pre><code>$ kubectl patch rolebinding my-rolebinding --patch "$(cat patch.yaml)"
rolebinding.rbac.authorization.k8s.io/my-rolebinding patched
</code></pre>
