<p>I want to allow a ServiceAccount in namespace A to access a resource in namespace B.
To achieve this I connect the ServiceAccount to a ClusterRole via a ClusterRoleBinding.
<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">The documentation</a> says I can &quot;use a ClusterRole to [1.] define permissions on namespaced resources and be granted within individual namespace(s)&quot;</p>
<p>But looking through the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#policyrule-v1-rbac-authorization-k8s-io" rel="nofollow noreferrer">K8s documentation</a> I can't find a way how to create a ClusterRole with namespaced resources. How can I achieve this?</p>

<p><code>...how to create a ClusterRole with namespaced resources...</code></p>
<p>Read further <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrole-example" rel="nofollow noreferrer">down</a> a bit:</p>
<blockquote>
<p>A ClusterRole can be used to grant the same permissions as a Role.
Because ClusterRoles are cluster-scoped. You can also use them to
grant access to:</p>
<p>...</p>
<ul>
<li>namespaced resources (like Pods), <strong>across all namespaces</strong></li>
</ul>
</blockquote>
<p><code>ClusterRole</code> won't help you to restraint access to a single namespaced object. You can however use <code>RoleBinding</code> to reference a <code>ClusterRole</code> and restraint access to the object in the namespace of the RoleBinding.</p>
