<p>I have 2 teams:</p>

<ul>
<li>devs: they create a new Kubernetes namespace each time they deploy a branch/tag of their app</li>
<li>ops: they manage access control to the cluster with (cluster)roles and (cluster)rolebindings</li>
</ul>

<p>The problem is that 'devs' cannot kubectl their namespaces until 'ops' have created RBAC resources. And 'devs' cannot create RBAC resources themselves as they don't have the list of subjects to put in the rolebinding resource (sharing the list is not an option).</p>

<p>I have read the official documentation about <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">Admission webhooks</a> but what I understood is that they only act on the resource that triggered the webhook.</p>

<p>Is there a native and/or simple way in Kubernetes to apply resources whenever a new namespace is created?</p>

blakelead
<p>I've come up with a solution by writing a custom controller.</p>
<p>With the following custom resource deployed, the controller injects the <code>role</code> and <code>rolebinding</code> in namespaces matching <code>dev-.*</code> and <code>fix-.*</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>kind: NamespaceResourcesInjector
apiVersion: blakelead.com/v1alpha1
metadata:
  name: nri-test
spec:
  namespaces:
  - dev-.*
  - fix-.*
  resources:
  - |
    apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      name: dev-role
    rules:
      - apiGroups: [&quot;&quot;]
        resources: [&quot;pods&quot;,&quot;pods/portforward&quot;, &quot;services&quot;, &quot;deployments&quot;, &quot;ingresses&quot;]
        verbs: [&quot;list&quot;, &quot;get&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;pods/portforward&quot;]
        verbs: [&quot;create&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;namespaces&quot;]
        verbs: [&quot;list&quot;, &quot;get&quot;]
  - |
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
      name: dev-rolebinding
    subjects:
    - kind: User
      name: dev
    roleRef:
      kind: Role
      name: dev-role
      apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>The controller is still in early stages of development but I'm using it successfully in more and more clusters.</p>
<p>Here it is for those interested: <a href="https://github.com/blakelead/nsinjector" rel="noreferrer">https://github.com/blakelead/nsinjector</a></p>
