<p>I want to create all-in-one.yaml kubernetes installer. But ran into the following error.</p>
<p>If I create ClusterRoleBinding, then <strong>subject.namespace</strong> is a required field. But during a kubectl apply, it is not replaced by a given namespace.</p>
<pre><code>kubectl apply -f all-in-one.yaml --namespace=infra
</code></pre>
<p>Her is ClusterRoleBinding from all-in-one.yaml</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: my-cr
subjects:
  - kind: ServiceAccount
    name: my-sa
    namespace: default
</code></pre>
<p>Is this a bug or should it be? Accordingly, the installation does not work correctly, because the ClusterRoleBinding does not bound with correct ServiceAccount. How can i solve this problem?</p>
<p>If i remove namespace from subject then I get an error.</p>
<pre><code>The ClusterRoleBinding &quot;my-crb&quot; is invalid: subjects[0].namespace: Required value
</code></pre>
<p>The only thing I can do is create ClusterRoleBinding separately from the all-in-one installation, then it works as it should.</p>
<pre><code>kubectl create clusterrolebinding my-crb --clusterrole=my-cr --serviceaccount=infra:my-sa
</code></pre>
<p>Thanks for the tips.</p>

<p>It's not a bug.  When <code>kubectl apply</code> creates or updates objects, <code>--namespace</code> sets the namespace those objects are in, but it doesn't try to otherwise affect or modify object contents.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-sa
  # namespace: infra  # &lt;-- kubectl --namespace affects this only
</code></pre>
<p>A templating tool like <a href="https://helm.sh" rel="nofollow noreferrer">Helm</a> can help here.  Helm lets you substitute parts of the YAML specification with variables or expressions, and it knows at install time what namespace it's installing into.  So in Helm you could say</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template &quot;my.name&quot; . }}-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template &quot;my.name&quot; . }}-cr
subjects:
  - kind: ServiceAccount
    name: {{ template &quot;my.name&quot; . }}-sa
    namespace: {{ .Release.Namespace }}
</code></pre>
<p>The last line substitutes the installation namespace in the CRB; I've also called a helper template to make the names of these various objects dynamic, so your application can be installed multiple times.  (<code>helm create</code> supplies a template chart that includes this helper for you.)</p>
