<p>In my scenario user has access to four namespaces only, he will switch between namespaces using contexts below. How can I give him access to CRD's along with his exiting access to four namespaces.</p>
<pre><code>CURRENT   NAME                      CLUSTER     AUTHINFO                       NAMESPACE
*         dev-crd-ns-user           dev         dev-crd-ns-user                dev-crd-ns
          dev-mon-fe-ns-user        dev         dev-mon-fe-ns-user             dev-mon-fe-ns
          dev-strimzi-operator-ns   dev         dev-strimzi-operator-ns-user   dev-strimzi-operator-ns
          dev-titan-ns-1            dev         dev-titan-ns-1-user            dev-titan-ns-1


hifi@101common:/root$ kubectl get secret
NAME                                     TYPE                                  DATA   AGE
default-token-mh7xq                      kubernetes.io/service-account-token   3      8d
dev-crd-ns-user-token-zd6xt   kubernetes.io/service-account-token   3      8d
exfo@cmme101common:/root$ kubectl get crd
Error from server (Forbidden): customresourcedefinitions.apiextensions.k8s.io is forbidden: User &quot;system:serviceaccount:dev-crd-ns:dev-crd-ns-user&quot; cannot list resource &quot;customresourcedefinitions&quot; in API group &quot;apiextensions.k8s.io&quot; at the cluster scope
</code></pre>
<p>Tried below two options. Option 2 is the recommendation but didn't work with either one.</p>
<pre><code>Error from server (Forbidden): customresourcedefinitions.apiextensions.k8s.io is forbidden: User &quot;system:serviceaccount:dev-crd-ns:dev-crd-ns-user&quot; cannot list resource &quot;customresourcedefinitions&quot; in API group &quot;apiextensions.k8s.io&quot; at the **cluster scope** 
</code></pre>
<h1>Option 1: Adding CRD to existing role</h1>
<h2>role</h2>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
  name: dev-ns-user-full-access
  namespace: dev-crd-ns
rules:
- apiGroups:
  - &quot;&quot;
  - extensions
  - apps
  - networking.k8s.io
  - apiextensions.k8s.io
  resources:
  - '*'
  - customresourcedefinitions
  verbs:
  - '*'
- apiGroups:
  - batch
  resources:
  - jobs
  - cronjobs
  verbs:
  - '*'
</code></pre>
<h2>role binding</h2>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
  name: dev-crd-ns-user-view
  namespace: dev-crd-ns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: dev-crd-ns-user-full-access
subjects:
- kind: ServiceAccount
  name: dev-crd-ns-user
  namespace: dev-crd-ns
</code></pre>
<h1>Option 2 : Adding CRD as a new role to &quot;dev-crd-ns&quot; namespace</h1>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev-crd-ns
  name: crd-admin
rules:
- apiGroups: [&quot;apiextensions.k8s.io&quot;] 
  resources: [&quot;customresourcedefinitions&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: crd-admin
  namespace: dev-crd-ns
subjects:
- kind: ServiceAccount
  name: dev-crd-ns-user
  namespace: dev-crd-ns
roleRef:
  kind: Role 
  name: crd-admin
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>You need to create <a href="https://v1-18.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/#role-example" rel="nofollow noreferrer">Role</a> and <a href="https://v1-20.docs.kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-example" rel="nofollow noreferrer">RoleBinding</a> for each service account like <code>dev-crd-ns-user</code>.</p>
<p>For <strong>dev-crd-ns-user</strong>:</p>
<ul>
<li>Update the existing Role or create a new one:</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev-crd-ns
  name: crd-admin
rules:
- apiGroups: [&quot;apiextensions.k8s.io&quot;] 
  resources: [&quot;customresourcedefinitions&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
</code></pre>
<pre class="lang-sh prettyprint-override"><code>$ kubectl apply -f crd-admin-role.yaml
</code></pre>
<ul>
<li>Update the existing RoleBinding with this new Role or create a new one:</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: crd-admin
  namespace: dev-crd-ns
subjects:
- kind: ServiceAccount
  name: dev-crd-ns-user
  namespace: dev-crd-ns
roleRef:
  kind: Role 
  name: crd-admin
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<pre class="lang-sh prettyprint-override"><code>$ kubectl apply -f crd-admin-role-binding.yaml
</code></pre>
<p>Now, the SA <code>dev-crd-ns-user</code> will have all the access to <code>customresourcedefinitions</code>.</p>
<p>Follow similar steps for the rest of the service accounts.</p>
