diff --git a/k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml b/k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml
new file mode 100644
index 000000000..9344e17c5
--- /dev/null
+++ b/k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml
@@ -0,0 +1,27 @@
+# permissions for end users to edit infisicalpushsecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: k8-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: infisicalpushsecret-editor-role
+rules:
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets/status
+    verbs:
+      - get
diff --git a/k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml b/k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml
new file mode 100644
index 000000000..ff4df91cc
--- /dev/null
+++ b/k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml
@@ -0,0 +1,23 @@
+# permissions for end users to view infisicalpushsecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: k8-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: infisicalpushsecret-viewer-role
+rules:
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets/status
+    verbs:
+      - get