<p>Say i have a k8s cluster.</p>
<p>I would like to restrict user to create their own namespace. And only allow admin to create namespace.</p>
<p>I am trying to use of cluster role rules:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-role
rules:
- apiGroups: [&quot;v1&quot;]
  resources: [&quot;namespaces&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
</code></pre>
<p>But I found user still can create namespace. Any solution to do so?</p>

<p>You need to create a ClusterRoleBinding to apply the ClusterRole <code>my-role</code> to the user. Assuming the user is <code>jane</code> below is an example. The problem in this approach is you need to keep updating it as and when new users gets onboarded.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: namespace-reader
subjects:
# You can specify more than one &quot;subject&quot;
- kind: User
  name: jane # &quot;name&quot; is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  # &quot;roleRef&quot; specifies the binding to a Role / ClusterRole
  kind: ClusterRole #this must be Role or ClusterRole
  name: my-role # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>An alternative and better approach would be to restrict all authenticated users from creating namespace using below ClusterRoleBinding. Since we are applying the ClusterRole to the group <code>system:authenticated</code> and every user who is successfully authenticated is placed into this group automatically by kubernetes, no user except admin user will be able to create namespace.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: namespace-reader
subjects:
# You can specify more than one &quot;subject&quot;
- kind: Group
  name: system:authenticated
  apiGroup: rbac.authorization.k8s.io
roleRef:
  # &quot;roleRef&quot; specifies the binding to a Role / ClusterRole
  kind: ClusterRole #this must be Role or ClusterRole
  name: my-role # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>Since admin user is part of a set of admin groups it will be possible to create namespace as admin user.</p>
