Repository: quarkusio/quarkus
Issue: Kubernetes config now requires explicit `view-secrets` authorization to access secrets that is not needed

### Describe the bug

I have application that uses the Quarkus Kubernetes config extension access OpenShift secret. When migrating to Quarkus 3.0, deployment fails over missing `view-secrets` authorization. I only access secrets that I created in namespace I also created with the same OpenShift user that I use for deployment, therefore I have sufficient rights to access the secrets. This worked in Quarkus 2.16.

### Expected behavior

Steps to reproduce worked with `stream=2.16` (also don't set `999-SNAPSHOT`), I'd like them to work again or have the change in behavior in https://github.com/quarkusio/quarkus/wiki/Migration-Guide-3.0#kubernetesopenshift.

### Actual behavior

Deployment fails
```
...
Caused by: java.lang.RuntimeException: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
18:49:09,959 INFO  mvn: 	[error]: Build step io.quarkus.kubernetes.deployment.KubernetesDeployer#deploy threw an exception: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://edited/apis/rbac.authorization.k8s.io/v1/namespaces/ts-dgbcvqufsb/rolebindings. Message: roles.rbac.authorization.k8s.io "view-secrets" not found. Received status: Status(apiVersion=v1, code=404, details=StatusDetails(causes=[], group=rbac.authorization.k8s.io, kind=roles, name=view-secrets, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=roles.rbac.authorization.k8s.io "view-secrets" not found, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=NotFound, status=Failure, additionalProperties={}).
18:49:09,959 INFO  mvn: 	at io.fabric8.kubernetes.client.KubernetesClientException.copyAsCause(KubernetesClientException.java:238)
18:49:09,959 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.waitForResult(OperationSupport.java:546)
18:49:09,959 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.handleResponse(OperationSupport.java:566)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.handleCreate(OperationSupport.java:350)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.handleCreate(BaseOperation.java:707)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.handleCreate(BaseOperation.java:93)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.CreateOnlyResourceOperation.create(CreateOnlyResourceOperation.java:42)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.utils.internal.CreateOrReplaceHelper.createOrReplace(CreateOrReplaceHelper.java:51)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.createOrReplace(BaseOperation.java:310)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.BaseOperation.createOrReplace(BaseOperation.java:93)
18:49:09,960 INFO  mvn: 	at io.fabric8.kubernetes.client.extension.ResourceAdapter.createOrReplace(ResourceAdapter.java:124)
18:49:09,960 INFO  mvn: 	at io.quarkus.kubernetes.deployment.KubernetesDeployer.deployResource(KubernetesDeployer.java:259)
18:49:09,960 INFO  mvn: 	at io.quarkus.kubernetes.deployment.KubernetesDeployer.lambda$deploy$4(KubernetesDeployer.java:219)
18:49:09,960 INFO  mvn: 	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
18:49:09,960 INFO  mvn: 	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:177)
18:49:09,960 INFO  mvn: 	at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1655)
18:49:09,960 INFO  mvn: 	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
18:49:09,960 INFO  mvn: 	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
18:49:09,960 INFO  mvn: 	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
18:49:09,961 INFO  mvn: 	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
18:49:09,961 INFO  mvn: 	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
18:49:09,961 INFO  mvn: 	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:497)
18:49:09,961 INFO  mvn: 	at io.quarkus.kubernetes.deployment.KubernetesDeployer.deploy(KubernetesDeployer.java:218)
18:49:09,961 INFO  mvn: 	at io.quarkus.kubernetes.deployment.KubernetesDeployer.deploy(KubernetesDeployer.java:142)
18:49:09,961 INFO  mvn: 	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
18:49:09,961 INFO  mvn: 	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
18:49:09,961 INFO  mvn: 	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
18:49:09,961 INFO  mvn: 	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
18:49:09,961 INFO  mvn: 	at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:909)
18:49:09,961 INFO  mvn: 	at io.quarkus.builder.BuildContext.run(BuildContext.java:282)
18:49:09,961 INFO  mvn: 	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
18:49:09,961 INFO  mvn: 	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
18:49:09,961 INFO  mvn: 	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
18:49:09,962 INFO  mvn: 	at java.base/java.lang.Thread.run(Thread.java:829)
18:49:09,962 INFO  mvn: 	at org.jboss.threads.JBossThread.run(JBossThread.java:501)
18:49:09,962 INFO  mvn: Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://edited/apis/rbac.authorization.k8s.io/v1/namespaces/ts-dgbcvqufsb/rolebindings. Message: roles.rbac.authorization.k8s.io "view-secrets" not found. Received status: Status(apiVersion=v1, code=404, details=StatusDetails(causes=[], group=rbac.authorization.k8s.io, kind=roles, name=view-secrets, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=roles.rbac.authorization.k8s.io "view-secrets" not found, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=NotFound, status=Failure, additionalProperties={}).
18:49:09,962 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.requestFailure(OperationSupport.java:701)
18:49:09,962 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.requestFailure(OperationSupport.java:681)
18:49:09,962 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.assertResponseCode(OperationSupport.java:630)
18:49:09,962 INFO  mvn: 	at io.fabric8.kubernetes.client.dsl.internal.OperationSupport.lambda$handleResponse$0(OperationSupport.java:591)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture$UniApply.tryFire(CompletableFuture.java:642)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2073)
18:49:09,962 INFO  mvn: 	at io.fabric8.kubernetes.client.http.StandardHttpClient.lambda$completeOrCancel$5(StandardHttpClient.java:120)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:859)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:837)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2073)
18:49:09,962 INFO  mvn: 	at io.fabric8.kubernetes.client.http.ByteArrayBodyHandler.onBodyDone(ByteArrayBodyHandler.java:52)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:859)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:837)
18:49:09,962 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:506)
18:49:09,963 INFO  mvn: 	at java.base/java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:2073)
18:49:09,963 INFO  mvn: 	at io.fabric8.kubernetes.client.vertx.VertxHttpRequest.lambda$null$1(VertxHttpRequest.java:122)
18:49:09,963 INFO  mvn: 	at io.vertx.core.impl.ContextInternal.dispatch(ContextInternal.java:264)
18:49:09,963 INFO  mvn: 	at io.vertx.core.impl.ContextInternal.dispatch(ContextInternal.java:246)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.HttpEventHandler.handleEnd(HttpEventHandler.java:76)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.HttpClientResponseImpl.handleEnd(HttpClientResponseImpl.java:250)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.Http1xClientConnection$StreamImpl.lambda$new$0(Http1xClientConnection.java:398)
18:49:09,963 INFO  mvn: 	at io.vertx.core.streams.impl.InboundBuffer.handleEvent(InboundBuffer.java:239)
18:49:09,963 INFO  mvn: 	at io.vertx.core.streams.impl.InboundBuffer.write(InboundBuffer.java:129)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.Http1xClientConnection$StreamImpl.handleEnd(Http1xClientConnection.java:645)
18:49:09,963 INFO  mvn: 	at io.vertx.core.impl.EventLoopContext.execute(EventLoopContext.java:76)
18:49:09,963 INFO  mvn: 	at io.vertx.core.impl.ContextBase.execute(ContextBase.java:232)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.Http1xClientConnection.handleResponseEnd(Http1xClientConnection.java:879)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.Http1xClientConnection.handleHttpMessage(Http1xClientConnection.java:751)
18:49:09,963 INFO  mvn: 	at io.vertx.core.http.impl.Http1xClientConnection.handleMessage(Http1xClientConnection.java:715)
18:49:09,963 INFO  mvn: 	at io.vertx.core.net.impl.ConnectionBase.read(ConnectionBase.java:157)
18:49:09,963 INFO  mvn: 	at io.vertx.core.net.impl.VertxHandler.channelRead(VertxHandler.java:153)
18:49:09,963 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
18:49:09,963 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
18:49:09,963 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
18:49:09,963 INFO  mvn: 	at io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
18:49:09,964 INFO  mvn: 	at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:346)
18:49:09,964 INFO  mvn: 	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:318)
18:49:09,964 INFO  mvn: 	at io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
18:49:09,964 INFO  mvn: 	at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1373)
18:49:09,964 INFO  mvn: 	at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1236)
18:49:09,964 INFO  mvn: 	at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1285)
18:49:09,964 INFO  mvn: 	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529)
18:49:09,964 INFO  mvn: 	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468)
18:49:09,964 INFO  mvn: 	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
18:49:09,964 INFO  mvn: 	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
18:49:09,964 INFO  mvn: 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
18:49:09,964 INFO  mvn: 	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
18:49:09,964 INFO  mvn: 	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
18:49:09,964 INFO  mvn: 	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788)
18:49:09,965 INFO  mvn: 	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724)
18:49:09,965 INFO  mvn: 	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650)
18:49:09,965 INFO  mvn: 	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
18:49:09,965 INFO  mvn: 	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
18:49:09,965 INFO  mvn: 	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
18:49:09,965 INFO  mvn: 	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
18:49:09,965 INFO  mvn: 	at java.base/java.lang.Thread.run(Thread.java:829)
18:49:09,965 INFO  mvn: 
...
```

### How to Reproduce?

Steps to reproduce:
1. `oc new-project mvavrik-debug`
2. `quarkus create app secret-reproducer -x openshift,resteasy-reactive,kubernetes-config --stream=3.0`
3. `cd secret-reproducer/`
4.
```
cat <<EOF > ./secret
apiVersion: v1
kind: Secret
metadata:
  name: app-config
stringData:
  application.properties: |
    msg=So Long, and Thanks for All the Fish
EOF
```
5. `oc apply -f secret`
6. `mvn clean verify -Dquarkus.platform.version=999-SNAPSHOT -Dquarkus.platform.group-id=io.quarkus -Dquarkus.kubernetes.deployment-target=openshift -Dquarkus.kubernetes.deploy=true -Dquarkus.kubernetes-client.trust-certs=true -Dquarkus.kubernetes-config.enabled=true -Dquarkus.kubernetes.config.secrets.enabled=true -Dquarkus.kubernetes-config.secrets=app-config -Dquarkus.kubernetes-config.secrets.enabled=true`

### Output of `uname -a` or `ver`

Linux

### Output of `java -version`

openjdk 17.0.8

### GraalVM version (if different from Java)

OpenJDK Runtime Environment GraalVM CE 22.3

### Quarkus version or git rev

999-SNAPSHOT

### Build tool (ie. output of `mvnw --version` or `gradlew --version`)

Apache Maven 3.8.6

### Additional information

Tested with OpenShift 4.12 (Kubernetes version v1.25.4+18eadca) and 4.8.

Changed files:
extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddClusterRoleResourceDecorator.java
integration-tests/kubernetes/quarkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java
extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddRoleResourceDecorator.java
extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddServiceAccountResourceDecorator.java

diff --git a/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddClusterRoleResourceDecorator.java b/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddClusterRoleResourceDecorator.java
index 2074e4fd122..d1309151483 100644
--- a/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddClusterRoleResourceDecorator.java
+++ b/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddClusterRoleResourceDecorator.java
@@ -7,6 +7,7 @@
 import java.util.List;
 import java.util.Map;
 
+import io.dekorate.kubernetes.decorator.Decorator;
 import io.dekorate.kubernetes.decorator.ResourceProvidingDecorator;
 import io.fabric8.kubernetes.api.model.KubernetesListBuilder;
 import io.fabric8.kubernetes.api.model.ObjectMeta;
@@ -45,4 +46,9 @@ public void visit(KubernetesListBuilder list) {
                 .endMetadata()
                 .withRules(rules));
     }
+
+    @Override
+    public Class<? extends Decorator>[] before() {
+        return new Class[] { AddRoleBindingResourceDecorator.class };
+    }
 }
diff --git a/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddRoleResourceDecorator.java b/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddRoleResourceDecorator.java
index 752efe7fd2b..632b3bca7bc 100644
--- a/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddRoleResourceDecorator.java
+++ b/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddRoleResourceDecorator.java
@@ -7,6 +7,7 @@
 import java.util.List;
 import java.util.Map;
 
+import io.dekorate.kubernetes.decorator.Decorator;
 import io.dekorate.kubernetes.decorator.ResourceProvidingDecorator;
 import io.fabric8.kubernetes.api.model.KubernetesListBuilder;
 import io.fabric8.kubernetes.api.model.ObjectMeta;
@@ -48,4 +49,9 @@ public void visit(KubernetesListBuilder list) {
                 .endMetadata()
                 .withRules(rules));
     }
+
+    @Override
+    public Class<? extends Decorator>[] before() {
+        return new Class[] { AddRoleBindingResourceDecorator.class };
+    }
 }
diff --git a/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddServiceAccountResourceDecorator.java b/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddServiceAccountResourceDecorator.java
index b8fb1f0eb8d..f6f90801b36 100644
--- a/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddServiceAccountResourceDecorator.java
+++ b/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/AddServiceAccountResourceDecorator.java
@@ -5,6 +5,7 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import io.dekorate.kubernetes.decorator.Decorator;
 import io.dekorate.kubernetes.decorator.ResourceProvidingDecorator;
 import io.fabric8.kubernetes.api.model.KubernetesListBuilder;
 import io.fabric8.kubernetes.api.model.ObjectMeta;
@@ -43,4 +44,9 @@ public void visit(KubernetesListBuilder list) {
                 .endMetadata()
                 .endServiceAccountItem();
     }
+
+    @Override
+    public Class<? extends Decorator>[] before() {
+        return new Class[] { AddRoleBindingResourceDecorator.class };
+    }
 }
diff --git a/integration-tests/kubernetes/quarkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java b/integration-tests/kubernetes/quarkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java
index 80ee1df0689..3ff3de62fb5 100644
--- a/integration-tests/kubernetes/quarkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java
+++ b/integration-tests/kubernetes/quarkus-standard-way/src/test/java/io/quarkus/it/kubernetes/KubernetesWithRbacFullTest.java
@@ -5,9 +5,12 @@
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.IOException;
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
 import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.RegisterExtension;
@@ -40,9 +43,16 @@ public class KubernetesWithRbacFullTest {
 
     @Test
     public void assertGeneratedResources() throws IOException {
-        final Path kubernetesDir = prodModeTestResults.getBuildDir().resolve("kubernetes");
-        List<HasMetadata> kubernetesList = DeserializationUtil
-                .deserializeAsList(kubernetesDir.resolve("kubernetes.yml"));
+        final Path kubernetesFile = prodModeTestResults.getBuildDir().resolve("kubernetes").resolve("kubernetes.yml");
+
+        // ensure rbac resources are generated in order: having the RoleBinding resource at the end:
+        String kubernetesFileContent = Files.readString(kubernetesFile);
+        int lastIndexOfRoleRefKind = lastIndexOfKind(kubernetesFileContent, "Role", "ClusterRole", "ServiceAccount");
+        int firstIndexOfRoleBinding = kubernetesFileContent.indexOf("kind: RoleBinding");
+        assertTrue(lastIndexOfRoleRefKind < firstIndexOfRoleBinding, "RoleBinding resource is created before "
+                + "the Role/ClusterRole/ServiceAccount resource!");
+
+        List<HasMetadata> kubernetesList = DeserializationUtil.deserializeAsList(kubernetesFile);
 
         Deployment deployment = getDeploymentByName(kubernetesList, APP_NAME);
         assertEquals(APP_NAMESPACE, deployment.getMetadata().getNamespace());
@@ -84,6 +94,21 @@ public void assertGeneratedResources() throws IOException {
         assertEquals("projectc", subject.getNamespace());
     }
 
+    private int lastIndexOfKind(String content, String... kinds) {
+        int index = Integer.MIN_VALUE;
+        for (String kind : kinds) {
+            Matcher matcher = Pattern.compile("(?m)^kind: " + kind).matcher(content);
+            if (matcher.find()) {
+                int lastIndexOfKind = matcher.end();
+                if (lastIndexOfKind > index) {
+                    index = lastIndexOfKind;
+                }
+            }
+        }
+
+        return index;
+    }
+
     private Deployment getDeploymentByName(List<HasMetadata> kubernetesList, String name) {
         return getResourceByName(kubernetesList, Deployment.class, name);
     }