<p>i have a service account which has access to one of the app namespace. I have created a cluster role and rolebinding and mapped it to the associated Service account in that namespace.
Everything works as expected except the listing/creation of PV on the cluster level. Can some please help.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dxf-clusterrole
rules:
  -
    apiGroups:
      - &quot;&quot;
      - apps
      - batch
      - extensions
      - policy
      - rbac.authorization.k8s.io
      - roles.rbac.authorization.k8s.io
      - authorization.k8s.io
    resources:
      - secrets
      - configmaps
      - deployments
      - endpoints
      - horizontalpodautoscalers
      - jobs
      - limitranges
      - namespaces
      - nodes
      - pods
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
      - role
      - rolebindings

    verbs:
      - get
      - watch
      - list
      - create
      - delete
  - nonResourceURLs: [&quot;*&quot;]
    verbs:
      - get
      - watch
      - list



apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  name: dxf-clusterrolebinding
  namespace: dxf-uat
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dxf-clusterrole
subjects:
- kind: ServiceAccount
  name: dxf-deployer
  namespace: dxf-uat
</code></pre>
<p>User &quot;system:serviceaccount:dxf-uat:dxf-deployer&quot; cannot get resource &quot;persistentvolumes&quot; in API group &quot;&quot; at the cluster scope</p>

cks cks
<p>There are four Kubernetes objects: <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">Role, ClusterRole</a>, <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">RoleBinding</a> and <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">ClusterRoleBinding</a>, that we can use to configure needed <strong>RBAC</strong> rules. <code>Role</code> and <code>RoleBinding</code> are namespaced and <code>ClusterRole</code> and <code>ClusterRoleBinding</code> are cluster scoped resources.</p>
<p>As you can see in the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding" rel="nofollow noreferrer">RoleBinding and ClusterRoleBinding documentation</a>:</p>
<blockquote>
<p>A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide.</p>
</blockquote>
<hr />
<p>Your problem is with all cluster-scope resources such as <code>PersistentVolumes</code>, <code>Nodes</code>, <code>Namespaces</code> etc:</p>
<pre><code>$ kubectl get nodes --as=system:serviceaccount:dxf-uat:dxf-deployer
Error from server (Forbidden): nodes is forbidden: User &quot;system:serviceaccount:dxf-uat:dxf-deployer&quot; cannot list resource &quot;nodes&quot; in API group &quot;&quot; at the cluster scope

$ kubectl get persistentvolumes -n dxf-uat --as=system:serviceaccount:dxf-uat:dxf-deployer
Error from server (Forbidden): persistentvolumes is forbidden: User &quot;system:serviceaccount:dxf-uat:dxf-deployer&quot; cannot list resource &quot;persistentvolumes&quot; in API group &quot;&quot; at the cluster scope

$ kubectl get namespaces --as=system:serviceaccount:dxf-uat:dxf-deployer
Error from server (Forbidden): namespaces is forbidden: User &quot;system:serviceaccount:dxf-uat:dxf-deployer&quot; cannot list resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope
</code></pre>
<p>You need to create a <code>ClusterRole</code> with all cluster scoped resources you want to have access from the <code>dxf-deployer</code> <code>ServiceAccount</code> and then bind this <code>ClusterRole</code> to the <code>dxf-deployer</code> <code>ServiceAccount</code> using <code>ClusterRoleBinding</code>.</p>
<p>In the example below, I've granted permissions for <code>dxf-deployer</code> <code>ServiceAccount</code> to <code>Nodes</code> and  <code>PersistentVolumes</code>:</p>
<pre><code>$ cat cluster-scope-permissions.yml
# cluster-scope-permissions.yml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-scope-role
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - nodes
  - persistentvolumes
  verbs:
  - get
  - list
  - watch
  - create
  - delete
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-scope-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-scope-role
subjects:
- kind: ServiceAccount
  name: dxf-deployer
  namespace: dxf-uat
</code></pre>
<p>Finally, we can check if it works as expected:</p>
<pre><code>$ kubectl apply -f cluster-scope-permissions.yml
clusterrole.rbac.authorization.k8s.io/cluster-scope-role created
clusterrolebinding.rbac.authorization.k8s.io/cluster-scope-rolebinding created


$ kubectl get nodes --as=system:serviceaccount:dxf-uat:dxf-deployer
NAME                                       STATUS   ROLES    AGE     VERSION
node1                                      Ready    &lt;none&gt;   5h11m   v1.18.12-gke.1210
node2                                      Ready    &lt;none&gt;   5h11m   v1.18.12-gke.1210

$ kubectl get persistentvolumes -n dxf-uat --as=system:serviceaccount:dxf-uat:dxf-deployer
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                STORAGECLASS   REASON   AGE
pvc-0ba2fd12-c883-45b8-b52d-a6c826a2775a   8Gi        RWO            Delete           Bound    default/my-jenkins   standard                131m
pvc-b4b7a4c8-c9ad-4e83-b1ee-663b3e4d938b   10Gi       RWO            Delete           Bound    default/debug-pvc    standard                5h12m
</code></pre>
