I think I understand cluster roles and bindings, my biggest thing is that I was using a bunch of off-the-shelf helm charts (for spinnaker, k8s dashboard, and deis workflow especially) and all three stopped working with RBAC. Those have been an...adventure to fix.