We are doing the exact same thing with Drone CI, however RBAC on the cluster is needed.

RBAC isn't too complicated though:

- get on specific app namespaces

- get, list, watch, patch, update on deployments