Kubectl-apply kubernetes rbac

Waypoint
1

What is “kubectl-apply” RBAC role that is least privileged for Kubernetes ?