<p>I'm trying to restrict a <code>ServiceAccount</code>'s RBAC permissions to manage secrets in all namespaces:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab-secrets-manager
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  resourceNames:
  - gitlab-registry
  verbs:
  - get
  - list
  - create
  - update
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-service-account
  namespace: gitlab
secrets:
- name: gitlab-service-account-token-lllll
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-service-account-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gitlab-secrets-manager
subjects:
- kind: ServiceAccount
  name: gitlab-service-account
  namespace: gitlab
</code></pre>

<p>So far, I've created the ServiceAccount and the related CRB, however, actions are failing:</p>

<pre><code>secrets "gitlab-registry" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "secrets" in API group "" in the namespace "shamil"
</code></pre>

<p>Anyone know what I'm missing?</p>

<p>You can do the following steps:</p>

<ul>
<li>At first, you need to insure that your serviceaccount named <code>gitlab-service-account</code> in  <code>gitlab</code> namespace exists in the cluster.</li>
<li>Then you will create a <code>ClusterRole</code> as you have given:</li>
</ul>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitlab-secrets-manager
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - gitlab-registry
    verbs:
      - get
      - list
      - create
      - update
</code></pre>

<ul>
<li>Then you will also create a <code>ClusterRoleBinding</code> to grant permission at the cluster level.</li>
</ul>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-secrets-manager-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: gitlab-service-account    
    namespace: gitlab
roleRef:
  kind: ClusterRole
  name: gitlab-secrets-manager
  apiGroup: rbac.authorization.k8s.io
</code></pre>
