<p>This is my <code>ClusterRoleBinding</code> and <code>ClusterRole</code> defination</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-namespaces
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bootstrap
subjects:
- kind: ServiceAccount
  name: executors
  namespace: bootstrap
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: bootstrap
rules:
- apiGroups:
  - '*'
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
</code></pre>
<p>The service account</p>
<pre><code>[node1 ~]$ kubectl  get sa executors  -n bootstrap -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2022-08-30T19:51:17Z&quot;
  name: executors
  namespace: bootstrap
  resourceVersion: &quot;2209&quot;
  uid: 488f5a2d-c44d-4db1-8d18-11a4f0206952
secrets:
- name: executors-token-2b2wl
</code></pre>
<p>The test Config</p>
<pre><code>[node1 ~]$ kubectl create namespace test  --as=executors
Error from server (Forbidden): namespaces is forbidden: User &quot;executors&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope
[no
</code></pre>
<pre><code>[node1 ~]$ kubectl auth can-i create namespace --as=executors
Warning: resource 'namespaces' is not namespace scoped
no
</code></pre>
<p>Why I'm getting the above error I did follow the k8's doc of ClusterRoleBinding here</p>

anish
<p>Try this and let me know how it goes.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-namespaces
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: bootstrap
subjects:
- kind: ServiceAccount
  name: executors
  namespace: bootstrap
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: bootstrap
rules:
- apiGroups:
  - ''
  resources:
  - namespaces
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - patch
  - delete
</code></pre>
<p>I see that in my cluster ClusterRole <code>system:controller:namespace-controller</code> have apiGroups of <code>''</code> instead of <code>'*'</code> seen in your original ClusterRole.</p>
