<p>The <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">documentation</a> says,</p>
<blockquote>
<p>If you want to define a role within a namespace, use a <code>Role</code>; if you want to define a role cluster-wide, use a <code>ClusterRole</code>.</p>
</blockquote>
<p>So, why am I able to create a <code>ClusterRole</code> in a namespace for a non-namespaced resource <code>StorageClass</code> (or, <code>sc</code> in short)?</p>
<pre class="lang-sh prettyprint-override"><code>kubectl -n apps create clusterrole scrole --verb=create,update,patch,delete --resource=sc
</code></pre>
<p>Also, is it correct to say that, a <code>Role</code> is applicable for namespaced resources <em>only</em> and <code>ClusterRole</code> for non-namespaced resources <em>only</em>?</p>

<p>The namespace parameter is redundant and not used even if you provide it while creating a <code>ClusterRole</code>.</p>
<p>A <code>ClusterRole</code> can define permission to namespace scoped resources as well and you can use a <code>RoleBinding</code> to assign the permission to a user or group or service account. When you do that it's basically providing permission to the resources within the namespace where the <code>RoleBinding</code> is created.This is to avoid creating duplicate <code>Roles</code> in every namespace to provide the same permission.</p>
<p>Also when you have cluster scoped resources in a <code>ClusterRole</code> you need to use a <code>ClusterRoleBinding</code> to assign the permission to a a user or group or service account.</p>
