<p>user1 and user2 have been assigned "admin" role in K8s cluster where they can only work within the namepsace they are assigned. In the case below, ns1 and ns2 respectively</p>

<p>user1 --> assigned namespace ns1</p>

<p>user2 --> assigned namespace ns2</p>

<p>user3 -->  assigned namespace ns3 and also have namespace-admin role assigned.
namespace-admin role (user3) should be able to create any resource in namespace ns3 and any new namespaces he creates in the cluster. This role should have ability to dynamically create new namespaces. But user3 should NOT  have access to ns1 or ns2 namespaces which is not created by user "user3".</p>

<p>user3 will be dynamically creating new namespaces and deploying workloads in those namespaces.</p>

<p>Can this be addressed ? This is similar to Openshift "Projects" concept.</p>

<p>Yes, you can restrict user3 to create/delete resources only in the namespace ns3 using a <code>Role</code> bind that role to user3. </p>

<p>Then you can use <code>ClusterRole</code> with only access to the <code>namespaces</code> resource and allow it to <code>create, delete, etc</code></p>

<p>Something like this:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: my-namespace
  name: user-namespace-role
rules:
- apiGroups: [""]
  resources: ["services", "endpoints", "pods"] # etc...
  verbs: ["get", "list", "create"] # etc
</code></pre>

<p>Then:</p>

<pre><code>kubectl create rolebinding user-namespace-binding --role=user-namespace-role --user=user3 --namespace=my-namespace
</code></pre>

<p>Then:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cluster-role-all-namespaces
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] # etc
</code></pre>

<p>Then:</p>

<pre><code>kubectl create clusterrolebinding all-namespaces-binding --clusterrole=cluster-role-all-namespaces --user=user3
</code></pre>

<p>For user1 and user2 you can create a <code>Role</code> and <code>RoleBinding</code> for their unique namespaces.</p>
