<p>I have the following:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: SomeServiceAccount
</code></pre>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: SomeClusterRole
rules:
  - apiGroups:
      - "myapi.com"
    resources:
      - 'myapi-resources'
    verbs:
      - '*'
</code></pre>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: SomeClusterRoleBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: SomeClusterRole
subjects:
  - kind: ServiceAccount
    name: SomeServiceAccount
</code></pre>

<p>But it throws:
<code>The ClusterRoleBinding "SomeClusterRoleBinding" is invalid: subjects[0].namespace: Required value</code></p>

<p>I thought the whole point of <code>"Cluster"RoleBinding</code> is that it's not limited to a single namespace. Anyone can explain this?</p>

<p>Kubernetes version <code>1.13.12</code>
Kubectl version <code>v1.16.2</code>
Thanks.</p>

<p>You are not required set a namespace while creating a ServiceAccount, the case here is that you are required to specify the namespace of your Service account when you refer to it while creating a ClusterRoleBinding to select it. </p>

<blockquote>
  <p>ServiceAccounts are namespace scoped subjects, so when you refer to
  them, you have to specify the namespace of the service account you
  want to bind. <a href="https://github.com/kubernetes/kubernetes/issues/29177#issuecomment-240712588" rel="noreferrer">Source</a></p>
</blockquote>

<p>In your case you can just use default namespace while creating your ClusterRoleBinding for example. </p>

<p>By doing this you are not tieing your ClusterRoleBinding to any namespace, as you can see in this example. </p>

<pre><code>$ kubectl get clusterrolebinding.rbac.authorization.k8s.io/tiller -o yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"tiller"},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"cluster-admin"},"subjects":[{"kind":"ServiceAccount","name":"tiller","namespace":"kube-system"}]}
  creationTimestamp: "2019-11-18T13:47:59Z"
  name: tiller
  resourceVersion: "66715"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/tiller
  uid: 085ed826-0a0a-11ea-a665-42010a8000f7
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: kube-system
</code></pre>
