<p>I have an application that has two parts: one deployer and the application runtime environment. The deployer needs to have access to different namespaces to be able to launch, edit and delete the application deployments, svc, configmaps, etc.</p>
<p>I first launch the deployer via a helm chart and then the deployer exposes some APIs to manage the application (launch, edit, delete).</p>
<p>My question is how to write the <code>ClusterRole</code> for my deployer that can only have access to a set of pre-created namespaces without giving it full cluster access (deployer should not be able to create, edit or delete namespaces). OR I have to create one <code>Role</code> for each of those namespaces and add them to the Helm chart of the deployer before installing it?</p>

<p>You can create a <code>ClusterRole</code> that will describe what the role can do. Then create a <code>RoleBinding</code> in each namespace you want the role user to have the priviliges. Here is a nice example from the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-example" rel="nofollow noreferrer">documentation</a>:</p>
<blockquote>
<p>A RoleBinding can also reference a ClusterRole to grant the permissions defined in that ClusterRole to resources inside the RoleBinding's namespace. This kind of reference lets you define a set of common roles across your cluster, then reuse them within multiple namespaces.</p>
<p>For instance, even though the following RoleBinding refers to a ClusterRole, &quot;dave&quot; (the subject, case sensitive) will only be able to read Secrets in the &quot;development&quot; namespace, because the RoleBinding's namespace (in its metadata) is &quot;development&quot;.</p>
</blockquote>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
# This role binding allows &quot;dave&quot; to read secrets in the &quot;development&quot; namespace.
# You need to already have a ClusterRole named &quot;secret-reader&quot;.
kind: RoleBinding
metadata:
  name: read-secrets
  #
  # The namespace of the RoleBinding determines where the permissions are granted.
  # This only grants permissions within the &quot;development&quot; namespace.
  namespace: development
subjects:
- kind: User
  name: dave # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io
</code></pre>
