kubectl apply --dry-run is very useful to test manifests.
There are differences of RBAC requirement with kubectl apply --dry-run=client and server.
Both need a role in fetching CRD to go through the validation admission chain and the mutating admission chain.
We need READ ONLY role for kubectl apply --dry-run=client and READ WRITE role for kubectl apply --dry-run=server
