<p>I have a Service Account which I'd like to grant permissions to read/write/update/delete Secrets within a specific namespace. I'm not clear about how exactly Service Accounts, Roles, Bindings, etc. work together to grant the right permissions.</p>

<p>What <code>kubectl</code> invocations or YAML do I need to do to grant these permissions to the service account?</p>

<p>Here's the YAML for the Service Account I have so far:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2018-10-09T17:45:20Z
  name: testaccount
  namespace: test
  resourceVersion: "369702913"
  selfLink: /api/v1/namespaces/test/serviceaccounts/testaccount
  uid: f742ed5c-c1b3-11e8-8a69-0ade4132ab56
secrets:
- name: testaccount-token-brjxq
</code></pre>

<p>You need to create Role and Role binding.</p>

<p>Create a role:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 namespace: test
 name: role-test-account
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
</code></pre>

<p>Create a role binding:</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: role-test-account-binding
 namespace: test
subjects:
- kind: ServiceAccount
  name: test-account
  namespace: test
roleRef:
 kind: Role
 name: role-test-account
 apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>You can read more about <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="noreferrer">using RBAC Authorization</a></p>
