kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: kube-backup-reader
rules:
- apiGroups: ["*"]
  resources: [
    "configmaps",
    "certificates",
    "cronjobs",
    "customresourcedefinitions",
    "deployments",
    "daemonsets",
    "ingresses",
    "issuers",
    "clusterissuers",
    "clusterroles",
    "clusterrolebindings",
    "elasticsearchclusters",
    "prometheuses",
    "servicemonitors",
    "alertmanagers",
    "namespaces",
    "networkpolicies",
    "replicationcontrollers",
    "services",
    "secrets",
    "statefulsets",
    "storageclasses",
    "persistentvolumeclaims",
    "roles",
    "rolebindings",
    "statefulsets",
    "storageclasses"
  ]
  verbs: ["get", "list"]

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: kube-backup
  namespace: default
subjects:
- kind: ServiceAccount
  name: kube-backup
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: kube-backup-reader
  apiGroup: rbac.authorization.k8s.io

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kube-backup-reader
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs: ["get", "list"]
---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kube-backup
  namespace: default
subjects:
- kind: ServiceAccount
  name: kube-backup
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: kube-backup-reader
  apiGroup: rbac.authorization.k8s.io

Update RBAC rules to allow read on any object in any API namespace
Update RBAC rules to allow read on any object in any API namespace
