From 098d5419a2a5bc9ecd3a3fcdc1a2f54e2d6ad0f8 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Wed, 28 Jan 2026 17:32:54 +0100
Subject: [PATCH 01/12] feat: update RBAC role and rolebinding templates with
 customizable resource rules (closes #561)

---
 charts/kor/templates/_helpers.tpl     | 38 +++++++++++++++
 charts/kor/templates/role.yaml        | 68 ++++-----------------------
 charts/kor/templates/rolebinding.yaml |  2 +
 charts/kor/values.yaml                | 10 ++++
 4 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index d33123b0..06fc1f18 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -74,3 +74,41 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Generate namespaced resource rules
+*/}}
+{{- define "kor.namespacedResourceRules" -}}
+{{- $resources := .Values.rbac.namespacedResources }}
+{{- if not $resources }}
+{{- $resources = list "pods" "configmaps" "secrets" "services" "serviceaccounts" "deployments" "statefulsets" "roles" "rolebindings" "horizontalpodautoscalers" "persistentvolumeclaims" "ingresses" "poddisruptionbudgets" "endpoints" "endpointslices" "jobs" "replicasets" "daemonsets" "networkpolicies" }}
+{{- end }}
+- apiGroups: ["*"]
+  resources:
+{{- range $resources }}
+    - {{ . }}
+{{- end }}
+  verbs:
+    - get
+    - list
+    - watch
+{{- end }}
+
+{{/*
+Generate cluster-scoped resource rules
+*/}}
+{{- define "kor.clusterResourceRules" -}}
+{{- $resources := .Values.rbac.clusterResources }}
+{{- if not $resources }}
+{{- $resources = list "namespaces" "clusterroles" "clusterrolebindings" "persistentvolumes" "customresourcedefinitions" "storageclasses" "volumeattachments" "priorityclasses" }}
+{{- end }}
+- apiGroups: ["*"]
+  resources:
+{{- range $resources }}
+    - {{ . }}
+{{- end }}
+  verbs:
+    - get
+    - list
+    - watch
+{{- end }}
diff --git a/charts/kor/templates/role.yaml b/charts/kor/templates/role.yaml
index 84dea7e5..b280da0f 100644
--- a/charts/kor/templates/role.yaml
+++ b/charts/kor/templates/role.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.rbac.create -}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -6,31 +7,7 @@ metadata:
   labels:
     {{- include "kor.labels" . | nindent 4 }}
 rules:
-  - apiGroups: ["*"]
-    resources:
-      - pods
-      - configmaps
-      - secrets
-      - services
-      - serviceaccounts
-      - deployments
-      - statefulsets
-      - roles
-      - rolebindings
-      - horizontalpodautoscalers
-      - persistentvolumeclaims
-      - ingresses
-      - poddisruptionbudgets
-      - endpoints
-      - endpointslices
-      - jobs
-      - replicasets
-      - daemonsets
-      - networkpolicies
-    verbs:
-      - get
-      - list
-      - watch
+{{ include "kor.namespacedResourceRules" . | nindent 2 }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -39,37 +16,10 @@ metadata:
   labels:
     {{- include "kor.labels" . | nindent 4 }}
 rules:
-  - apiGroups: ["*"]
-    resources:
-      - pods
-      - configmaps
-      - secrets
-      - services
-      - serviceaccounts
-      - deployments
-      - statefulsets
-      - roles
-      - rolebindings
-      - horizontalpodautoscalers
-      - persistentvolumeclaims
-      - ingresses
-      - poddisruptionbudgets
-      - endpoints
-      - endpointslices
-      - jobs
-      - replicasets
-      - daemonsets
-      - networkpolicies
-      {{/* cluster-scoped resources */}}
-      - namespaces
-      - clusterroles
-      - clusterrolebindings
-      - persistentvolumes
-      - customresourcedefinitions
-      - storageclasses
-      - volumeattachments
-      - priorityclasses
-    verbs:
-      - get
-      - list
-      - watch
+{{ include "kor.namespacedResourceRules" . | nindent 2 }}
+{{- $clusterRes := .Values.rbac.clusterResources }}
+# If clusterResources is not defined or is a non-empty list, include cluster resource rules.
+{{- if or (not (kindIs "slice" $clusterRes)) (gt (len $clusterRes) 0) }}
+{{ include "kor.clusterResourceRules" . | nindent 2 }}
+{{- end }}
+{{- end }}
diff --git a/charts/kor/templates/rolebinding.yaml b/charts/kor/templates/rolebinding.yaml
index 43a63f9e..d4cae359 100644
--- a/charts/kor/templates/rolebinding.yaml
+++ b/charts/kor/templates/rolebinding.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.rbac.create -}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -27,3 +28,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "kor.serviceAccountName" . }}-read-resources-clusterrole
   apiGroup: rbac.authorization.k8s.io
+{{- end }}
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index 781a602c..5baf5c0f 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -97,3 +97,13 @@ serviceAccount:
   # -- The name of the service account to use.
   # -- If not set and create is true, a name is generated using the fullname template
   name: ""
+
+rbac:
+  # -- Create Role and ClusterRole
+  create: true
+  # -- Namespaced resources (used in both Role and ClusterRole)
+  # -- Set to array to customize, null for defaults
+  namespacedResources: null
+  # -- Cluster-scoped resources (ClusterRole only)
+  # -- Set to array to customize, null for defaults, empty array to disable
+  clusterResources: null

From 5762513fc8f9eeaa5e14703f7834774ac52f9fa1 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Wed, 28 Jan 2026 21:51:02 +0100
Subject: [PATCH 02/12] feat: simplify RBAC configuration with customizable
 role and cluster role creation

---
 charts/kor/templates/_helpers.tpl     | 33 ++++++++++++---------------
 charts/kor/templates/role.yaml        | 13 ++++-------
 charts/kor/templates/rolebinding.yaml |  4 +++-
 charts/kor/values.yaml                | 10 +++-----
 4 files changed, 26 insertions(+), 34 deletions(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index 06fc1f18..e5224355 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -76,31 +76,28 @@ Create the name of the service account to use
 {{- end }}
 
 {{/*
-Generate namespaced resource rules
+Check if Role should be created
 */}}
-{{- define "kor.namespacedResourceRules" -}}
-{{- $resources := .Values.rbac.namespacedResources }}
-{{- if not $resources }}
-{{- $resources = list "pods" "configmaps" "secrets" "services" "serviceaccounts" "deployments" "statefulsets" "roles" "rolebindings" "horizontalpodautoscalers" "persistentvolumeclaims" "ingresses" "poddisruptionbudgets" "endpoints" "endpointslices" "jobs" "replicasets" "daemonsets" "networkpolicies" }}
+{{- define "kor.createRole" -}}
+{{- $create := .Values.rbac.create -}}
+{{- if or (eq (toString $create) "true") (eq $create "role") }}true{{- end }}
 {{- end }}
-- apiGroups: ["*"]
-  resources:
-{{- range $resources }}
-    - {{ . }}
-{{- end }}
-  verbs:
-    - get
-    - list
-    - watch
+
+{{/*
+Check if ClusterRole should be created
+*/}}
+{{- define "kor.createClusterRole" -}}
+{{- $create := .Values.rbac.create -}}
+{{- if or (eq (toString $create) "true") (eq $create "clusterrole") }}true{{- end }}
 {{- end }}
 
 {{/*
-Generate cluster-scoped resource rules
+Generate resource rules
 */}}
-{{- define "kor.clusterResourceRules" -}}
-{{- $resources := .Values.rbac.clusterResources }}
+{{- define "kor.resourceRules" -}}
+{{- $resources := .Values.rbac.resources }}
 {{- if not $resources }}
-{{- $resources = list "namespaces" "clusterroles" "clusterrolebindings" "persistentvolumes" "customresourcedefinitions" "storageclasses" "volumeattachments" "priorityclasses" }}
+{{- $resources = list "pods" "configmaps" "secrets" "services" "serviceaccounts" "deployments" "statefulsets" "roles" "rolebindings" "horizontalpodautoscalers" "persistentvolumeclaims" "ingresses" "poddisruptionbudgets" "endpoints" "endpointslices" "jobs" "replicasets" "daemonsets" "networkpolicies" "namespaces" "clusterroles" "clusterrolebindings" "persistentvolumes" "customresourcedefinitions" "storageclasses" "volumeattachments" "priorityclasses" }}
 {{- end }}
 - apiGroups: ["*"]
   resources:
diff --git a/charts/kor/templates/role.yaml b/charts/kor/templates/role.yaml
index b280da0f..662bddca 100644
--- a/charts/kor/templates/role.yaml
+++ b/charts/kor/templates/role.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create -}}
+{{- if include "kor.createRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -7,7 +7,9 @@ metadata:
   labels:
     {{- include "kor.labels" . | nindent 4 }}
 rules:
-{{ include "kor.namespacedResourceRules" . | nindent 2 }}
+{{ include "kor.resourceRules" . | nindent 2 }}
+{{- end }}
+{{- if include "kor.createClusterRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -16,10 +18,5 @@ metadata:
   labels:
     {{- include "kor.labels" . | nindent 4 }}
 rules:
-{{ include "kor.namespacedResourceRules" . | nindent 2 }}
-{{- $clusterRes := .Values.rbac.clusterResources }}
-# If clusterResources is not defined or is a non-empty list, include cluster resource rules.
-{{- if or (not (kindIs "slice" $clusterRes)) (gt (len $clusterRes) 0) }}
-{{ include "kor.clusterResourceRules" . | nindent 2 }}
-{{- end }}
+{{ include "kor.resourceRules" . | nindent 2 }}
 {{- end }}
diff --git a/charts/kor/templates/rolebinding.yaml b/charts/kor/templates/rolebinding.yaml
index d4cae359..a0cddcca 100644
--- a/charts/kor/templates/rolebinding.yaml
+++ b/charts/kor/templates/rolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create -}}
+{{- if include "kor.createRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -13,6 +13,8 @@ roleRef:
   kind: Role
   name: {{ include "kor.serviceAccountName" . }}-read-resources-role
   apiGroup: rbac.authorization.k8s.io
+{{- end }}
+{{- if include "kor.createClusterRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index 5baf5c0f..7ff4c8c8 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -99,11 +99,7 @@ serviceAccount:
   name: ""
 
 rbac:
-  # -- Create Role and ClusterRole
+  # -- Create Role and/or ClusterRole (true, false, "clusterrole" or "role")
   create: true
-  # -- Namespaced resources (used in both Role and ClusterRole)
-  # -- Set to array to customize, null for defaults
-  namespacedResources: null
-  # -- Cluster-scoped resources (ClusterRole only)
-  # -- Set to array to customize, null for defaults, empty array to disable
-  clusterResources: null
+  # -- Resources to grant access to (null for defaults, array to customize)
+  resources: null

From b8e94cfe39c33a79af621830ad7e9c626d8d11da Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Wed, 28 Jan 2026 22:04:59 +0100
Subject: [PATCH 03/12] feat: customize RBAC `apiGroups`

---
 charts/kor/templates/_helpers.tpl | 5 ++++-
 charts/kor/values.yaml            | 3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index e5224355..96bb2269 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -99,7 +99,10 @@ Generate resource rules
 {{- if not $resources }}
 {{- $resources = list "pods" "configmaps" "secrets" "services" "serviceaccounts" "deployments" "statefulsets" "roles" "rolebindings" "horizontalpodautoscalers" "persistentvolumeclaims" "ingresses" "poddisruptionbudgets" "endpoints" "endpointslices" "jobs" "replicasets" "daemonsets" "networkpolicies" "namespaces" "clusterroles" "clusterrolebindings" "persistentvolumes" "customresourcedefinitions" "storageclasses" "volumeattachments" "priorityclasses" }}
 {{- end }}
-- apiGroups: ["*"]
+- apiGroups:
+{{- range .Values.rbac.apiGroups }}
+    - {{ . | quote }}
+{{- end }}
   resources:
 {{- range $resources }}
     - {{ . }}
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index 7ff4c8c8..2baf9534 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -103,3 +103,6 @@ rbac:
   create: true
   # -- Resources to grant access to (null for defaults, array to customize)
   resources: null
+  # -- API groups to grant access to
+  apiGroups:
+    - "*"

From 03d81cef65ea3fd772c751f92a7951da3149c527 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Wed, 28 Jan 2026 22:10:50 +0100
Subject: [PATCH 04/12] feat: simplify RBAC configuration with default resource
 rules

---
 charts/kor/templates/_helpers.tpl |  6 +-----
 charts/kor/values.yaml            | 31 +++++++++++++++++++++++++++++--
 2 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index 96bb2269..e686e07f 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -95,16 +95,12 @@ Check if ClusterRole should be created
 Generate resource rules
 */}}
 {{- define "kor.resourceRules" -}}
-{{- $resources := .Values.rbac.resources }}
-{{- if not $resources }}
-{{- $resources = list "pods" "configmaps" "secrets" "services" "serviceaccounts" "deployments" "statefulsets" "roles" "rolebindings" "horizontalpodautoscalers" "persistentvolumeclaims" "ingresses" "poddisruptionbudgets" "endpoints" "endpointslices" "jobs" "replicasets" "daemonsets" "networkpolicies" "namespaces" "clusterroles" "clusterrolebindings" "persistentvolumes" "customresourcedefinitions" "storageclasses" "volumeattachments" "priorityclasses" }}
-{{- end }}
 - apiGroups:
 {{- range .Values.rbac.apiGroups }}
     - {{ . | quote }}
 {{- end }}
   resources:
-{{- range $resources }}
+{{- range .Values.rbac.resources }}
     - {{ . }}
 {{- end }}
   verbs:
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index 2baf9534..176a6193 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -101,8 +101,35 @@ serviceAccount:
 rbac:
   # -- Create Role and/or ClusterRole (true, false, "clusterrole" or "role")
   create: true
-  # -- Resources to grant access to (null for defaults, array to customize)
-  resources: null
+  # -- Resources to grant access to
+  resources:
+    - pods
+    - configmaps
+    - secrets
+    - services
+    - serviceaccounts
+    - deployments
+    - statefulsets
+    - roles
+    - rolebindings
+    - horizontalpodautoscalers
+    - persistentvolumeclaims
+    - ingresses
+    - poddisruptionbudgets
+    - endpoints
+    - endpointslices
+    - jobs
+    - replicasets
+    - daemonsets
+    - networkpolicies
+    - namespaces
+    - clusterroles
+    - clusterrolebindings
+    - persistentvolumes
+    - customresourcedefinitions
+    - storageclasses
+    - volumeattachments
+    - priorityclasses
   # -- API groups to grant access to
   apiGroups:
     - "*"

From db4c487b366d4ccc912a337ba56e92610f451d2e Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Wed, 28 Jan 2026 22:13:51 +0100
Subject: [PATCH 05/12] feat: add customizable RBAC verbs

---
 charts/kor/templates/_helpers.tpl | 6 +++---
 charts/kor/values.yaml            | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index e686e07f..fb2b8491 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -104,7 +104,7 @@ Generate resource rules
     - {{ . }}
 {{- end }}
   verbs:
-    - get
-    - list
-    - watch
+{{- range .Values.rbac.verbs }}
+    - {{ . }}
+{{- end }}
 {{- end }}
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index 176a6193..f62b2df0 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -133,3 +133,8 @@ rbac:
   # -- API groups to grant access to
   apiGroups:
     - "*"
+  # -- Verbs to grant
+  verbs:
+    - get
+    - list
+    - watch

From 5fd5b8a94729cfcf7737a548448e286deb221f07 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Thu, 29 Jan 2026 12:18:11 +0100
Subject: [PATCH 06/12] chore: bump chart version

---
 charts/kor/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/kor/Chart.yaml b/charts/kor/Chart.yaml
index c217e328..f91c8eb8 100644
--- a/charts/kor/Chart.yaml
+++ b/charts/kor/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kor
 description: A Kubernetes Helm Chart to discover orphaned resources using kor
 type: application
-version: 0.2.12
+version: 0.2.13
 appVersion: "0.6.7"
 maintainers:
   - name: "yonahd"

From 0230e2516a511827e64851c627ee9651003c36e6 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Mon, 2 Feb 2026 15:26:55 +0100
Subject: [PATCH 07/12] feat: improve RBAC configuration structure

This commit changes from flat list configs to an array of rules.
---
 charts/kor/templates/_helpers.tpl |   8 +-
 charts/kor/values.yaml            | 154 +++++++++++++++++++++++-------
 2 files changed, 122 insertions(+), 40 deletions(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index fb2b8491..e749fcdb 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -95,16 +95,18 @@ Check if ClusterRole should be created
 Generate resource rules
 */}}
 {{- define "kor.resourceRules" -}}
+{{- range .Values.rbac.rules }}
 - apiGroups:
-{{- range .Values.rbac.apiGroups }}
+{{- range .apiGroups }}
     - {{ . | quote }}
 {{- end }}
   resources:
-{{- range .Values.rbac.resources }}
+{{- range .resources }}
     - {{ . }}
 {{- end }}
   verbs:
-{{- range .Values.rbac.verbs }}
+{{- range .verbs }}
     - {{ . }}
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index f62b2df0..652922a0 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -101,40 +101,120 @@ serviceAccount:
 rbac:
   # -- Create Role and/or ClusterRole (true, false, "clusterrole" or "role")
   create: true
-  # -- Resources to grant access to
-  resources:
-    - pods
-    - configmaps
-    - secrets
-    - services
-    - serviceaccounts
-    - deployments
-    - statefulsets
-    - roles
-    - rolebindings
-    - horizontalpodautoscalers
-    - persistentvolumeclaims
-    - ingresses
-    - poddisruptionbudgets
-    - endpoints
-    - endpointslices
-    - jobs
-    - replicasets
-    - daemonsets
-    - networkpolicies
-    - namespaces
-    - clusterroles
-    - clusterrolebindings
-    - persistentvolumes
-    - customresourcedefinitions
-    - storageclasses
-    - volumeattachments
-    - priorityclasses
-  # -- API groups to grant access to
-  apiGroups:
-    - "*"
-  # -- Verbs to grant
-  verbs:
-    - get
-    - list
-    - watch
+  # -- RBAC rules with proper API group to resource mappings
+  rules:
+    # Core API resources
+    - apiGroups:
+        - ""
+      resources:
+        - pods
+        - configmaps
+        - secrets
+        - services
+        - serviceaccounts
+        - persistentvolumeclaims
+        - endpoints
+        - namespaces
+        - persistentvolumes
+      verbs:
+        - get
+        - list
+        - watch
+    # Apps API resources
+    - apiGroups:
+        - apps
+      resources:
+        - deployments
+        - statefulsets
+        - replicasets
+        - daemonsets
+      verbs:
+        - get
+        - list
+        - watch
+    # Networking API resources
+    - apiGroups:
+        - networking.k8s.io
+      resources:
+        - ingresses
+        - networkpolicies
+      verbs:
+        - get
+        - list
+        - watch
+    # RBAC API resources
+    - apiGroups:
+        - rbac.authorization.k8s.io
+      resources:
+        - roles
+        - rolebindings
+        - clusterroles
+        - clusterrolebindings
+      verbs:
+        - get
+        - list
+        - watch
+    # Autoscaling API resources
+    - apiGroups:
+        - autoscaling
+      resources:
+        - horizontalpodautoscalers
+      verbs:
+        - get
+        - list
+        - watch
+    # Policy API resources
+    - apiGroups:
+        - policy
+      resources:
+        - poddisruptionbudgets
+      verbs:
+        - get
+        - list
+        - watch
+    # Batch API resources
+    - apiGroups:
+        - batch
+      resources:
+        - jobs
+      verbs:
+        - get
+        - list
+        - watch
+    # Discovery API resources
+    - apiGroups:
+        - discovery.k8s.io
+      resources:
+        - endpointslices
+      verbs:
+        - get
+        - list
+        - watch
+    # Storage API resources
+    - apiGroups:
+        - storage.k8s.io
+      resources:
+        - storageclasses
+        - volumeattachments
+      verbs:
+        - get
+        - list
+        - watch
+    # Scheduling API resources
+    - apiGroups:
+        - scheduling.k8s.io
+      resources:
+        - priorityclasses
+      verbs:
+        - get
+        - list
+        - watch
+    # API extensions resources
+    - apiGroups:
+        - apiextensions.k8s.io
+      resources:
+        - customresourcedefinitions
+      verbs:
+        - get
+        - list
+        - watch

From 61b3d78361c97ee16b16cfa268149b71934e3a1d Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Tue, 3 Feb 2026 17:03:38 +0100
Subject: [PATCH 08/12] docs: update README.md

---
 charts/kor/README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/charts/kor/README.md b/charts/kor/README.md
index a60896df..3ec15c1f 100644
--- a/charts/kor/README.md
+++ b/charts/kor/README.md
@@ -1,6 +1,6 @@
 # kor
 
-![Version: 0.2.12](https://img.shields.io/badge/Version-0.2.12-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square)
+![Version: 0.2.13](https://img.shields.io/badge/Version-0.2.13-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square)
 
 A Kubernetes Helm Chart to discover orphaned resources using kor
 
@@ -58,6 +58,8 @@ A Kubernetes Helm Chart to discover orphaned resources using kor
 | prometheusExporter.serviceMonitor.targetLabels | list | `[]` | Set of labels to transfer on the Kubernetes Service onto the target. |
 | prometheusExporter.serviceMonitor.telemetryPath | string | `"/metrics"` |  |
 | prometheusExporter.serviceMonitor.timeout | string | `"10s"` | Set timeout for scrape |
+| rbac.create | bool | `true` | Create Role and/or ClusterRole (true, false, "clusterrole" or "role") |
+| rbac.rules | list | `[{"apiGroups":[""],"resources":["pods","configmaps","secrets","services","serviceaccounts","persistentvolumeclaims","endpoints","namespaces","persistentvolumes"],"verbs":["get","list","watch"]},{"apiGroups":["apps"],"resources":["deployments","statefulsets","replicasets","daemonsets"],"verbs":["get","list","watch"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses","networkpolicies"],"verbs":["get","list","watch"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles","rolebindings","clusterroles","clusterrolebindings"],"verbs":["get","list","watch"]},{"apiGroups":["autoscaling"],"resources":["horizontalpodautoscalers"],"verbs":["get","list","watch"]},{"apiGroups":["policy"],"resources":["poddisruptionbudgets"],"verbs":["get","list","watch"]},{"apiGroups":["batch"],"resources":["jobs"],"verbs":["get","list","watch"]},{"apiGroups":["discovery.k8s.io"],"resources":["endpointslices"],"verbs":["get","list","watch"]},{"apiGroups":["storage.k8s.io"],"resources":["storageclasses","volumeattachments"],"verbs":["get","list","watch"]},{"apiGroups":["scheduling.k8s.io"],"resources":["priorityclasses"],"verbs":["get","list","watch"]},{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"],"verbs":["get","list","watch"]}]` | RBAC rules with proper API group to resource mappings |
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template |

From deaaac5658a22bcdf22b269a636c667a40b21d64 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Thu, 19 Feb 2026 12:41:43 +0100
Subject: [PATCH 09/12] chore: bump chart version

---
 charts/kor/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/kor/Chart.yaml b/charts/kor/Chart.yaml
index f91c8eb8..6f0a38ac 100644
--- a/charts/kor/Chart.yaml
+++ b/charts/kor/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: kor
 description: A Kubernetes Helm Chart to discover orphaned resources using kor
 type: application
-version: 0.2.13
+version: 0.2.14
 appVersion: "0.6.7"
 maintainers:
   - name: "yonahd"

From 50fddd31f29559e3335ee64b652469e4eae01ab4 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Thu, 19 Feb 2026 14:51:32 +0100
Subject: [PATCH 10/12] chore: update version badge

---
 charts/kor/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/kor/README.md b/charts/kor/README.md
index 6c701f9c..3c0c7daf 100644
--- a/charts/kor/README.md
+++ b/charts/kor/README.md
@@ -1,6 +1,6 @@
 # kor
 
-![Version: 0.2.13](https://img.shields.io/badge/Version-0.2.13-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square)
+![Version: 0.2.14](https://img.shields.io/badge/Version-0.2.14-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square)
 
 A Kubernetes Helm Chart to discover orphaned resources using kor
 

From 7c3071fe1eeb1c78cc243b99187b6dffaa6492fa Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Mon, 23 Feb 2026 14:56:20 +0100
Subject: [PATCH 11/12] feat: simplify RBAC rules structure and set default
 verbs

---
 charts/kor/templates/_helpers.tpl |  14 +--
 charts/kor/values.yaml            | 148 +++++++-----------------------
 2 files changed, 41 insertions(+), 121 deletions(-)

diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl
index e749fcdb..ff1e3c53 100644
--- a/charts/kor/templates/_helpers.tpl
+++ b/charts/kor/templates/_helpers.tpl
@@ -101,12 +101,14 @@ Generate resource rules
     - {{ . | quote }}
 {{- end }}
   resources:
-{{- range .resources }}
-    - {{ . }}
-{{- end }}
+    {{- toYaml .resources | nindent 4 }}
   verbs:
-{{- range .verbs }}
-    - {{ . }}
-{{- end }}
+  {{- if .verbs }}
+    {{- toYaml .verbs | nindent 4 }}
+  {{- else }}
+    - get
+    - list
+    - watch
+  {{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml
index 14cf35d0..866a0a70 100644
--- a/charts/kor/values.yaml
+++ b/charts/kor/values.yaml
@@ -106,119 +106,37 @@ rbac:
   # -- Create Role and/or ClusterRole (true, false, "clusterrole" or "role")
   create: true
   # -- RBAC rules with proper API group to resource mappings
+  # -- Verbs default to [get, list, watch] if not specified
   rules:
-    # Core API resources
-    - apiGroups:
-        - ""
-      resources:
-        - pods
-        - configmaps
-        - secrets
-        - services
-        - serviceaccounts
-        - persistentvolumeclaims
-        - endpoints
-        - namespaces
-        - persistentvolumes
-      verbs:
-        - get
-        - list
-        - watch
-    # Apps API resources
-    - apiGroups:
-        - apps
-      resources:
-        - deployments
-        - statefulsets
-        - replicasets
-        - daemonsets
-      verbs:
-        - get
-        - list
-        - watch
-    # Networking API resources
-    - apiGroups:
-        - networking.k8s.io
-      resources:
-        - ingresses
-        - networkpolicies
-      verbs:
-        - get
-        - list
-        - watch
-    # RBAC API resources
-    - apiGroups:
-        - rbac.authorization.k8s.io
-      resources:
-        - roles
-        - rolebindings
-        - clusterroles
-        - clusterrolebindings
-      verbs:
-        - get
-        - list
-        - watch
-    # Autoscaling API resources
-    - apiGroups:
-        - autoscaling
-      resources:
-        - horizontalpodautoscalers
-      verbs:
-        - get
-        - list
-        - watch
-    # Policy API resources
-    - apiGroups:
-        - policy
-      resources:
-        - poddisruptionbudgets
-      verbs:
-        - get
-        - list
-        - watch
-    # Batch API resources
-    - apiGroups:
-        - batch
-      resources:
-        - jobs
-      verbs:
-        - get
-        - list
-        - watch
-    # Discovery API resources
-    - apiGroups:
-        - discovery.k8s.io
-      resources:
-        - endpointslices
-      verbs:
-        - get
-        - list
-        - watch
-    # Storage API resources
-    - apiGroups:
-        - storage.k8s.io
-      resources:
-        - storageclasses
-        - volumeattachments
-      verbs:
-        - get
-        - list
-        - watch
-    # Scheduling API resources
-    - apiGroups:
-        - scheduling.k8s.io
-      resources:
-        - priorityclasses
-      verbs:
-        - get
-        - list
-        - watch
-    # API extensions resources
-    - apiGroups:
-        - apiextensions.k8s.io
-      resources:
-        - customresourcedefinitions
-      verbs:
-        - get
-        - list
-        - watch
+    - apiGroups: [""]
+      resources: ["pods", "configmaps", "secrets", "services", "serviceaccounts", "persistentvolumeclaims", "endpoints", "namespaces", "persistentvolumes"]
+
+    - apiGroups: ["apps"]
+      resources: ["deployments", "statefulsets", "replicasets", "daemonsets"]
+
+    - apiGroups: ["networking.k8s.io"]
+      resources: ["ingresses", "networkpolicies"]
+
+    - apiGroups: ["rbac.authorization.k8s.io"]
+      resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
+
+    - apiGroups: ["autoscaling"]
+      resources: ["horizontalpodautoscalers"]
+
+    - apiGroups: ["policy"]
+      resources: ["poddisruptionbudgets"]
+
+    - apiGroups: ["batch"]
+      resources: ["jobs"]
+
+    - apiGroups: ["discovery.k8s.io"]
+      resources: ["endpointslices"]
+
+    - apiGroups: ["storage.k8s.io"]
+      resources: ["storageclasses", "volumeattachments"]
+
+    - apiGroups: ["scheduling.k8s.io"]
+      resources: ["priorityclasses"]
+
+    - apiGroups: ["apiextensions.k8s.io"]
+      resources: ["customresourcedefinitions"]

From d0b99f057f3fac403573655de223041aadd57a18 Mon Sep 17 00:00:00 2001
From: Sleeyax <yourd3veloper@gmail.com>
Date: Fri, 27 Feb 2026 02:25:49 +0100
Subject: [PATCH 12/12] docs: update README.md

---
 charts/kor/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/kor/README.md b/charts/kor/README.md
index 3c0c7daf..203e9c4f 100644
--- a/charts/kor/README.md
+++ b/charts/kor/README.md
@@ -63,7 +63,7 @@ A Kubernetes Helm Chart to discover orphaned resources using kor
 | prometheusExporter.serviceMonitor.telemetryPath | string | `"/metrics"` |  |
 | prometheusExporter.serviceMonitor.timeout | string | `"10s"` | Set timeout for scrape |
 | rbac.create | bool | `true` | Create Role and/or ClusterRole (true, false, "clusterrole" or "role") |
-| rbac.rules | list | `[{"apiGroups":[""],"resources":["pods","configmaps","secrets","services","serviceaccounts","persistentvolumeclaims","endpoints","namespaces","persistentvolumes"],"verbs":["get","list","watch"]},{"apiGroups":["apps"],"resources":["deployments","statefulsets","replicasets","daemonsets"],"verbs":["get","list","watch"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses","networkpolicies"],"verbs":["get","list","watch"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles","rolebindings","clusterroles","clusterrolebindings"],"verbs":["get","list","watch"]},{"apiGroups":["autoscaling"],"resources":["horizontalpodautoscalers"],"verbs":["get","list","watch"]},{"apiGroups":["policy"],"resources":["poddisruptionbudgets"],"verbs":["get","list","watch"]},{"apiGroups":["batch"],"resources":["jobs"],"verbs":["get","list","watch"]},{"apiGroups":["discovery.k8s.io"],"resources":["endpointslices"],"verbs":["get","list","watch"]},{"apiGroups":["storage.k8s.io"],"resources":["storageclasses","volumeattachments"],"verbs":["get","list","watch"]},{"apiGroups":["scheduling.k8s.io"],"resources":["priorityclasses"],"verbs":["get","list","watch"]},{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"],"verbs":["get","list","watch"]}]` | RBAC rules with proper API group to resource mappings |
+| rbac.rules | list | `[{"apiGroups":[""],"resources":["pods","configmaps","secrets","services","serviceaccounts","persistentvolumeclaims","endpoints","namespaces","persistentvolumes"]},{"apiGroups":["apps"],"resources":["deployments","statefulsets","replicasets","daemonsets"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses","networkpolicies"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles","rolebindings","clusterroles","clusterrolebindings"]},{"apiGroups":["autoscaling"],"resources":["horizontalpodautoscalers"]},{"apiGroups":["policy"],"resources":["poddisruptionbudgets"]},{"apiGroups":["batch"],"resources":["jobs"]},{"apiGroups":["discovery.k8s.io"],"resources":["endpointslices"]},{"apiGroups":["storage.k8s.io"],"resources":["storageclasses","volumeattachments"]},{"apiGroups":["scheduling.k8s.io"],"resources":["priorityclasses"]},{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"]}]` | Verbs default to [get, list, watch] if not specified |
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template |