<p>I'm going over RBAC in Kubernetes. It appears to me that</p>

<ul>
<li>a ServiceAccount can be bound to a Role within a namespace
(or)</li>
<li>a ServiceAccount can be bound to a ClusterRole and have cluster-wide access (all namespaces?)</li>
</ul>

<p>Is it possible for a single Service Account (or User) to not have cluster-wide access but only have read-only access in only a subset of namespaces? If so, can someone elaborate on how this can be achieved. Thanks!</p>

<p>You need to create a RoleBinding for every namespace in each namespace the ServiceAccount should have access to.</p>

<p>There is an example to give the default ServiceAccount permissions to read pods in the <code>development</code> namespace. </p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-secrets
  namespace: development # This only grants permissions within the "development" namespace.
subjects:
- kind: ServiceAccount
  name: default
  namespace: kube-system
roleRef:
  kind: Role
  name: pod-reader 
  apiGroup: rbac.authorization.k8s.io
</code></pre>
