In addition to the upstream effort described below, the downtream manifest generator needs to use the experimental rbac resoureces when generating the experimental manifests.

UPSTREAM:

Kubebuilder uses tags to generate RBAC for controllers, if a controller is disabled in the standard manifest, then RBAC should not be generated for that controller.

This does not require a new generator (like the crd-generator), but go build tags can be used. The tags would only be passed to the kubebuilder generator.

Experimental controllers would need to include the following comment:

//go:build !standard 

Note the negation of the standard tag. This is because the executable build does not specify standard nor experimental. Only the generation does.

The same can be done for webhooks as RBAC.