nix/hosts/common/configs/system/kubernetes/options/addons/addon-manager/default.nix

{ ... }:
[
  {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "Role";
    metadata = {
      name = "system:kube-addon-manager";
      namespace = "kube-system";
    };
    rules = [
      {
        apiGroups = [ "*" ];
        resources = [ "*" ];
        verbs = [ "*" ];
      }
    ];
  }
  {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "RoleBinding";
    metadata = {
      name = "system:kube-addon-manager";
      namespace = "kube-system";
    };
    roleRef = {
      apiGroup = "rbac.authorization.k8s.io";
      kind = "Role";
      name = "system:kube-addon-manager";
    };
    subjects = [
      {
        apiGroup = "rbac.authorization.k8s.io";
        kind = "User";
        name = "system:kube-addon-manager";
      }
    ];
  }
  {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "ClusterRole";
    metadata = {
      name = "system:kube-addon-manager:cluster-lister";
    };
    rules = [
      {
        apiGroups = [ "*" ];
        resources = [ "*" ];
        verbs = [ "list" ];
      }
    ];
  }
  {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "ClusterRoleBinding";
    metadata = {
      name = "system:kube-addon-manager:cluster-lister";
    };
    roleRef = {
      apiGroup = "rbac.authorization.k8s.io";
      kind = "ClusterRole";
      name = "system:kube-addon-manager:cluster-lister";
    };
    subjects = [
      {
        kind = "User";
        name = "system:kube-addon-manager";
      }
    ];
  }
]