<p>I am trying to Create User With Limited Namespace Access. created namespace named as test and also created Group:programmers, User:frontend. Generated credentials  for user:frontend by the help of following <a href="http://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">http://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/</a></p>

<p>I created a role. Here is my role.yml  </p>

<pre><code>kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
    namespace: test
    name: frontend-developer
 rules:
 - apiGroups: ["","extensions","apps"]
   resources: ["deployments","replicasets","pods"]
   verbs: ["get","list","watch","create","patch"]`
</code></pre>

<p>I created rolebinding. Here is role-binding.yml</p>

<pre><code>kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: frontend-deploy
   namespace: test
 subjects:
 - kind: User
   name: frontend
   namespace: test
 roleRef:
   kind: Role
   name: frontend-developer
   apiGroup: rbac.authorization.k8s.io 
</code></pre>

<p>I am talking my deployment file as</p>

<pre><code>apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
   name: nodefrontend
   namespace: test
 spec:
   replicas: 3
   template:
     metadata:
       labels:
         app: bookstore
     spec:
       containers:
       - name: nodeweb
         image: balipalligayathri/devops-develop
         ports:
         - name: http
           containerPort: 3000
           protocol: TCP 
</code></pre>

<p>I am using following commands while creating the role and rolebinding</p>

<pre><code>$ kubectl create -f role.yml
$ kubectl create -f role-binding.yml 
</code></pre>

<p>frontend developer Role and frontend-deploy Rolebindings were created.</p>

<p>Again, i am using the command <code>kubectl create -f node-deployment.yml</code> for deployment creation. Deployment was created and deleted successfully. here, i didn't mention any user while creating the deployment.so, I am trying to create deployment with user by using the below command.</p>

<pre><code>kubectl create -f node-deployment.yml --as=frontend --context=frontend-context
</code></pre>

<p>I am facing the error like this</p>

<pre><code>Error from server (Forbidden):

&lt;html&gt;&lt;head&gt;&lt;meta http-equiv='refresh' content='1;url=/login?from=%2Fswagger-2.0.0.pb-v1%3Ftimeout%3D32s'/&gt;&lt;script&gt;window.location.replace('/login?from=%2Fswagger-2.0.0.pb-v1%3Ftimeout%3D32s');&lt;/script&gt;&lt;/head&gt;&lt;body style='background-color:white; color:white;'&gt;
    Authentication requiredhttps://stackoverflow.com/questions/48164369/kubernetes-   1-8-dashboard-configurations-fails-with-error-no-kind-role-is-regi
    You are authenticated as: anonymous
    Groups that you are in:
    Permission you need to have (but didn't): hudson.model.Hudson.Read
    which is implied by: hudson.security.Permission.GenericRead
    which is implied by: hudson.model.Hudson.Administer    &lt;/body&gt;&lt;/html&gt;
</code></pre>

<p>My doubt is: is there any necessity to mention the user in <code>deployment.yml</code> file? </p>

BSG
<p>You need to create a <code>serviceAccount</code>, take a look at this snippet:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: myAccount
</code></pre>

<p>bind it to your role:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: myBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: frontend-developer
subjects:
- kind: ServiceAccount
  name: myAccount
</code></pre>

<p>and use it in your Deployment:</p>

<pre><code>apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
   name: nodefrontend
   namespace: test
spec:
  template:
    metadata:
      labels:
        ...
    spec:
      serviceAccountName: myAccount
</code></pre>

<p>Ref: </p>

<ul>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/</a></li>
<li><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a></li>
</ul>
