<p>I have a RBAC enabled Kubernetes cluster in GCP</p>

<p>There are <strong>one</strong> namespace <strong>for Tiller</strong> and <strong>multiple for Services</strong></p>

<p>Right now, I can assign reader role for a specific service account given it's full name</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: tiller-reader
  namespace: tiller
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - "get"
    - "watch"
    - "list"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tiller-reader-role-binding
  namespace: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tiller-reader
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: system:serviceaccount:my-namespace-1:my-namespace-1-service-account
</code></pre>

<p>The <strong>Service</strong> namespaces and accounts are <strong>created dynamically</strong>. How do I <strong>automatically give</strong> all services accounts <strong>access</strong> to the Tiller namespace, for example: to get pods?</p>

<p>to grant a role to all service accounts you must use the Group system:serviceaccounts. </p>

<p>you can try the following config :</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  name: tiller-reader
  namespace: tiller
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs:
    - "get"
    - "watch"
    - "list"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tiller-reader-role-binding
  namespace: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tiller-reader
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:serviceaccounts
</code></pre>
