<p>I am playing around with Minikube and I created a test user with certificates (mueller). He has set the CN of his certificate to mueller and the O to development.</p>

<p>Here is my role: </p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 namespace: development
 name: read-development-pods
rules:
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get", "list", "watch"]
</code></pre>

<p>and my rolebinding:  </p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: read-development-pods-rb
 namespace: development
subjects:
- kind: User
  name: mueller
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: read-development-pods
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Also I got my certificates set to the kubeconfig. The rules work fine.</p>

<p>Now my question is, can I get rid of my rolebinding, because having a rolebinding for each user is not very comfortable and I think I read somewhere that Kubernetes is able to use the O-field of the users certificate to automatically bind to the roles that are written in that field.  </p>

ItFreak
<p>Whenever you've successfully confirmed entity object within one of K8s Authentication <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies" rel="nofollow noreferrer">strategies</a> in Kubernetes API, typical request may consists of some <a href="http://ttps://kubernetes.io/docs/reference/access-authn-authz/authorization/#review-your-request-attributes" rel="nofollow noreferrer">attribute</a> properties which defines a way how the cluster visitor can be authorized through one of the specific <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#authorization-modules" rel="nofollow noreferrer">modules</a>.</p>

<p>As per official Kubernetes <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#x509-client-certs" rel="nofollow noreferrer">documentation</a>:</p>

<blockquote>
  <p>As of Kubernetes 1.4, client certificates can also indicate a user’s
  group memberships using the certificate’s organization fields. To
  include multiple group memberships for a user, include multiple
  organization fields in the certificate.</p>
  
  <p>For example, using the openssl command line tool to generate a
  certificate signing request:</p>
  
  <p><strong>openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj
  "/CN=jbeda/O=app1/O=app2"</strong></p>
</blockquote>
