app-assembler.yaml

apiVersion: kappctrl.k14s.io/v1alpha1
kind: App
metadata:
  name: cobbler
  namespace: cobbler
spec:
  serviceAccountName: cobbler
  fetch:
    - inline:
        paths:
          config.yaml: |
            #@ load("@ytt:library", "library")
            #@ load("@ytt:template", "template")
            #@ load("@ytt:overlay", "overlay")

            #@ def set_namespace():
            #@overlay/match by=overlay.all, expects="1+"
            ---
            metadata:
              #@overlay/match missing_ok=True
              namespace: cobbler
            #@ end

            --- #@ template.replace(overlay.apply(library.get("greeter").with_data_values({"hello_msg": "from the cobbler App!"}).eval(), set_namespace()))
      path: base
    - git:
        url: https://github.com/vmware-tanzu/carvel-simple-app-on-kubernetes
        ref: 045973afee4648df09493207d63c81b0a6f9444a
        subPath: config-step-2-template
      path: greeter/_ytt_lib/greeter
  template:
    - ytt:
        paths:
          - base
          - greeter
  deploy:
    - kapp: {}

cobbler-sa.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: cobbler
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cobbler
  namespace: cobbler
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cobbler-ns-role
  namespace: cobbler
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cobbler-ns-role-binding
  namespace: cobbler
subjects:
- kind: ServiceAccount
  name: cobbler
  namespace: cobbler
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cobbler-ns-role