<p>My NodeJS microservice is deployed to k8s cluster.</p>
<p>I would like this microservice to access the k8s API server.  For that, I guess I need to create a <code>ServiceAccount</code> for it. So I did this:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-service-account
  namespace: myapp-ns
</code></pre>
<p>Then, I also created a <code>ClusterRole</code> to define the permissions:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: myapp-cluster-role
  namespace: myapp-ns
rules:
- apiGroups: [&quot;*&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
</code></pre>
<p>Finally, I created a <code>ClusterRoleBinding</code>:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-app-role-binding
  namespace: myapp-ns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: myapp-cluster-role
subjects:
  kind: ServiceAccount
  name: my-app-service-account
</code></pre>
<p>When I deploy them (I use Ansible to do the deployment), I get the following error:</p>
<pre><code>&quot;error&quot;: 400, &quot;msg&quot;: &quot;Failed to create object: b'{\&quot;kind\&quot;:\&quot;Status\&quot;,\&quot;apiVersion\&quot;:\&quot;v1\&quot;,\&quot;metadata\&quot;:{},\&quot;status\&quot;:\&quot;Failure\&quot;,\&quot;message\&quot;:\&quot;ClusterRoleBinding in version \\\\\&quot;v1\\\\\&quot; cannot be handled as a ClusterRoleBinding: json: cannot unmarshal object into Go struct field ClusterRoleBinding.subjects of type []v1.Subject\&quot;,\&quot;reason\&quot;:\&quot;BadRequest\&quot;,\&quot;code\&quot;:400}\\n'&quot;,
</code></pre>
<p>Why this error? Where am I wrong?</p>

<p>I'd reckon the issue is with the resources, not with Ansible.</p>
<p>Take a look:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: myapp-cluster-role
  namespace: myapp-ns # &lt;-- NOT A NAMESPACED RESOURCE
rules:
- apiGroups: [&quot;*&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-app-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: myapp-cluster-role
subjects:
- kind: ServiceAccount # &lt;-- Added (-)
  name: my-app-service-account
  namespace: myapp-ns # &lt;-- MOVED FROM METADATA
</code></pre>
<p>To summarize:</p>
<ul>
<li><code>Clusterrole</code> is a not a namespaced resource, hence you should not specify it</li>
<li>You've missed a <code>-</code> in the <code>.subjects</code></li>
<li>You should move <code>.namespace</code> from <code>.metadata</code> to <code>.suspects...</code></li>
</ul>
<p>More explanation on namespaced/non namespaced resources:</p>
<ul>
<li><code>kubectl api-resources </code></li>
</ul>
<pre class="lang-bash prettyprint-override"><code>NAME                              SHORTNAMES   APIVERSION 
roles                                          rbac.authorization.k8s.io/v1           true         Role
clusterrolebindings                            rbac.authorization.k8s.io/v1           false        ClusterRoleBinding
clusterroles                                   rbac.authorization.k8s.io/v1           false        ClusterRole
rolebindings                                   rbac.authorization.k8s.io/v1           true         RoleBinding
</code></pre>
<p>I encourage you to check on the following docs:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: Access Authn Authz: RBAC</a></em></li>
<li><em><a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#not-all-objects-are-in-a-namespace" rel="nofollow noreferrer">Kubernetes.io: Docs: Concepts: Overview: Working with objects: Namespaces: Not all objects are in a namespace</a></em></li>
</ul>
