<p>I'm trying to provision emepheral environments via automation leveraging Kubernetes namespaces. My automation workers deployed in Kubernetes must be able to create Namespaces. So far my experimentation with this led me nowhere. Which binding do I need to attach to the Service Account to allow it to control Namespaces? Or is my approach wrong?</p>
<p>My code so far:</p>
<p><code>deployment.yaml</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8s-deployer
  namespace: tooling
  labels:
    app: k8s-deployer
spec:
  replicas: 1
  selector:
    matchLabels:
      app: k8s-deployer 
  template:
    metadata:
      name: k8s-deployer
      labels:
        app: k8s-deployer
    spec:
      serviceAccountName: k8s-deployer
      containers: ...
</code></pre>
<p><code>rbac.yaml</code>:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-deployer
  namespace: tooling

---

# this lets me view namespaces, but not write
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: administer-cluster
subjects:
- kind: ServiceAccount
  name: k8s-deployer
  namespace: tooling
roleRef:
  kind: ClusterRole
  name: admin
  apiGroup: rbac.authorization.k8s.io

</code></pre>

<p>To give a pod control over something in Kubernetes you need at least four things:</p>
<ol>
<li>Create or select existing <code>Role</code>/<code>ClusterRole</code> (you picked <code>administer-cluster</code>, which rules are unknown to me).</li>
<li>Create or select existing <code>ServiceAccount</code> (you created <code>k8s-deployer</code> in namespace <code>tooling</code>).</li>
<li>Put the two together with <code>RoleBinding</code>/<code>ClusterRoleBinding</code>.</li>
<li>Assign the <code>ServiceAccount</code> to a pod.</li>
</ol>
<p>Here's an example that can manage namespaces:</p>
<pre class="lang-yaml prettyprint-override"><code># Create a service account
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8s-deployer
  namespace: tooling
---
# Create a cluster role that allowed to perform 
# [&quot;get&quot;, &quot;list&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;patch&quot;] over [&quot;namespaces&quot;]
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8s-deployer
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;namespaces&quot;]
    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;patch&quot;]
---
# Associate the cluster role with the service account
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8s-deployer
  # make sure NOT to mention 'namespace' here or
  # the permissions will only have effect in the
  # given namespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8s-deployer
subjects:
- kind: ServiceAccount
  name: k8s-deployer
  namespace: tooling
</code></pre>
<p>After that you need to mention the service account name in pod <code>spec</code> as you already did. More info about RBAC in the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">documentation</a>.</p>
