Describe the bug
With your recent fix on role.yaml (#16776), We’re running into a problem with the chart when using rbac.namespaced=true along with sidecar.rules.enabled=true. The error message is "Failed to create resource: roles.rbac.authorization.k8s.io.s is forbidden. User "system:service:account:" cannot create resources roles in API group "rbac.authorization.k8s.io" in the namespace . As per our internal policy, the service account that runs Helm upgrades does not have permission to create or modify Roles or RoleBindings.

Right now, with this configuration, the chart always tries to create a Role, which causes the deployment to fail. We’d like to continue using namespaced RBAC with the sidecar enabled, but avoid Helm failing because of RBAC restrictions.

Could you advise on options here?

• Is there a supported way to tell the chart not to manage RBAC objects.
• If not today, would you consider adding a flag like rbac.create: false (or similar) to skip generating Roles/RoleBindings with this configuration?
• Any documented workaround you recommend until then?

To Reproduce
Steps to reproduce the behavior:
Deploy the loki latest chart version - 6.36.0 with rbac.namespaced=true along with sidecar.rules.enabled=true in values yaml file.

Error Message: "The error message is "Failed to create resource: roles.rbac.authorization.k8s.io.s is forbidden. User "system:service:account:" cannot create resources roles in API group "rbac.authorization.k8s.io" in the namespace "

Environment:

• Infrastructure: [Kubernetes]
• Deployment tool: [helm]