<p>I want to allow a ServiceAccount in namespace A to access a resource in namespace B.
To achieve this I connect the ServiceAccount to a ClusterRole via a ClusterRoleBinding.
<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">The documentation</a> says I can &quot;use a ClusterRole to [1.] define permissions on namespaced resources and be granted within individual namespace(s)&quot;</p>
<p>But looking through the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#policyrule-v1-rbac-authorization-k8s-io" rel="nofollow noreferrer">K8s documentation</a> I can't find a way how to create a ClusterRole with namespaced resources. How can I achieve this?</p>

Natjo
<p>I find both other answers a little confusing, hopefully this is clearer.</p>
<p>You did the right thing in creating a <code>ClusterRole</code>, but you want to bind it using a namespaced <code>RoleBinding</code>, <em>not</em> a <code>ClusterRoleBinding</code>.</p>
<p>Example using your examples. Notice how the <code>RoleBinding</code> is in the B namespace, giving A's <code>ServiceAccount</code> the permissions defined in the <code>ClusterRole</code>, but limited to the B namespace.</p>
<pre class="lang-yaml prettyprint-override"><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: what-a-is-allowed-to-do-in-b
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;deployments&quot;] # etc
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;create&quot;]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app
  namespace: namespace-a
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: what-a-is-allowed-to-do-in-b
  namespace: namespace-b
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: what-a-is-allowed-to-do-in-b
subjects:
- kind: ServiceAccount
  name: my-app
  namespace: namespace-a
</code></pre>
<p>Notes:
You have to use the ClusterRole because you can't get outside your own namespace without one. By using a <code>RoleBinding</code>, which is namespaced, you can then limit the access to the scope of the namespace of that <code>RoleBinding</code>.</p>
