<p>I am trying to add new user to EKS cluster and giving then access. So far I was able to add the user just by editing <code>configmap/aws-auth</code> (<code>kubectl edit -n kube-system configmap/aws-auth</code>) and adding new user to </p>

<pre><code>mapUsers: |
 - userarn: arn:aws:iam::123456789:user/user01
   username: user01
   groups:
     - system:masters
</code></pre>

<p>How can add user to EKS cluster and give full access to to specific namespace, but nothing outside of it ?</p>

<p>I tried to create Roles &amp; RoleBinding as </p>

<pre><code>---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: namespace1
  name: namespace1-user
rules:
- apiGroups: ["*"] 
  resources: ["*"]
  verbs: ["*"]


# This role binding allows "user01" to read pods in the "namespace1" namespace.
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: namespace1-user-role-binding
  namespace: namespace1
subjects:
- kind: User
  name: user01
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: namespace1-user
</code></pre>

<p><code>user01</code> can see all the pods from other users with <code>kubectl get pods --all-namespaces</code>, is there any way to restrict this ?</p>

<p>Essentially what you want is to define a cluster role and use a role binding to apply it to a specific namespace. Using a cluster role (rather than a role) allows you to re-use it across namespaces. Using a role binding allows you to target a specific namespace rather than giving cluster-wide permissions.</p>
