<p>Is it possible to have more than one role bind to a single service account?</p>

codeogeek
<p>This is possible to have multiple <code>RoleBindings</code> / <code>ClusterRoleBindings</code> that link <code>Roles</code> / <code>ClusterRoles</code> to single <code>ServiceAccount</code>.</p>
<p>You should remember that permissions are <strong>additive</strong> - you can add another <code>Role</code> /  <code>ClusterRole</code> to <code>ServiceAccount</code> to extend its permissions.</p>
<hr />
<p>I've created simple example to illustrate you how it works.</p>
<p>First I created <code>red</code> and <code>blue</code> <code>Namespaces</code> and <code>test-sa</code> <code>ServiceAccount</code>:</p>
<pre><code>$ kubectl create namespace red
namespace/red created
$ kubectl create namespace blue
namespace/blue created
$ kubectl create serviceaccount test-sa
serviceaccount/test-sa created
</code></pre>
<p>By default, the newly created <code>test-sa</code> <code>ServiceAccount</code> doesn't have any permissions:</p>
<pre><code>$ kubectl auth can-i get pod -n red --as=system:serviceaccount:default:test-sa
no
$ kubectl auth can-i get pod -n blue --as=system:serviceaccount:default:test-sa
no
$ kubectl auth can-i get pod -n default --as=system:serviceaccount:default:test-sa
no
</code></pre>
<p>Next I created two <code>pod-reader-red</code> and <code>pod-reader-blue</code> <code>Roles</code> that have permissions to get <code>Pods</code> in <code>red</code> and <code>blue</code> <code>Namespaces</code> accordingly:</p>
<pre><code>$ kubectl create role pod-reader-red --verb=get --resource=pods -n red
role.rbac.authorization.k8s.io/pod-reader-red created
$ kubectl create role pod-reader-blue --verb=get --resource=pods -n blue
role.rbac.authorization.k8s.io/pod-reader-blue created
</code></pre>
<p>And then using <code>RoleBinding</code> I linked this <code>Roles</code> to <code>test-sa</code> <code>ServiceAccount</code>:</p>
<pre><code>$ kubectl create rolebinding pod-reader-red --role=pod-reader-red --serviceaccount=default:test-sa -n red
rolebinding.rbac.authorization.k8s.io/pod-reader-red created
$ kubectl create rolebinding pod-reader-blue --role=pod-reader-blue --serviceaccount=default:test-sa -n blue
rolebinding.rbac.authorization.k8s.io/pod-reader-blue created
</code></pre>
<p>Finally we can check that <code>test-sa</code> <code>ServiceAccount</code> has permission to get <code>Pods</code> in <code>red</code> <code>Namespace</code> using <code>pod-reader-red</code> <code>Role</code>
and <code>test-sa</code> <code>ServiceAccount</code> has permission to get <code>Pods</code> in <code>blue</code> <code>Namespace</code> using <code>pod-reader-blue</code> <code>Role</code>:</p>
<pre><code>$ kubectl auth can-i get pod -n red --as=system:serviceaccount:default:test-sa
yes
$ kubectl auth can-i get pod -n blue --as=system:serviceaccount:default:test-sa
yes
$ kubectl auth can-i get pod -n default --as=system:serviceaccount:default:test-sa
no
</code></pre>
