<p>I created a service account that contains the default cluster role "view" which makes it can access all of our resources with view permission.</p>

<p>But I would like to add a limitation so that this service account can't access one of our namespace.</p>

<p>Any idea how can I achieve this?</p>

<p>Br,</p>

<p>Tim</p>

<p>Kubernetes has only two permission scopes: Cluster(<code>ClusterRole</code>) or Namespace(<code>Role</code>) and no way to limit or exclude a <code>ClusterRole</code> to specific namespaces. If you want to restrict your ServiceAccount to specific namespaces you cannot use a <code>ClusterRole</code> but must use a <code>Role</code> in every namespace the ServiceAccount should have access in. </p>
