<p>I have a set of <code>users(dev-team)</code> who need access only to <code>dev</code> and <code>qa</code> namespaces. I created a service account, cluster role and cluster role binding as shown below.</p>

<p><strong>Service Account</strong></p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: dev-team
</code></pre>

<p><strong>Cluster role</strong> </p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: dev-team-users
rules:
  - apiGroups: ["rbac.authorization.k8s.io",""]
    resources: ["namespaces"]
    resourceNames: ["dev","qa"]
    verbs: ["get","list","create"]
</code></pre>

<p><strong>Cluster role binding</strong> </p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: dev-team-user-bindings
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dev-team-users
subjects:
- kind: User
  name: dev-team
  namespace: kube-system
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>When I try to verify the access 
<code>kubectl get namespaces --as=dev-team</code></p>

<p>I get the below error message</p>

<pre><code>Error from server (Forbidden): namespaces is forbidden: User "dev-team" cannot list resource "namespaces" in API group "" at the cluster scope
</code></pre>

<p>I am expecting to see only <code>dev</code> and <code>qa</code> namespaces to show up. Am I missing something here?</p>

Niranjan
<p>The <em>list</em> operation fails because you are using the <code>resourceNames</code> field in the ClusterRole to restrict the namespace objects to grant access too but <em>list</em> would return <em>all</em> namespace objects.</p>

<p><strong>But I guess what you really want is to restrict access to the resources <em>in</em> a namespace, and not the namespace objects themselves (which contain not much more information than the name of the namespace).</strong></p>

<p>To achieve this, you have to create Roles (or a ClusterRole) and RoleBindings in those namespaces that you want to grant access to the users.</p>

<p>Here is how you can grant access to all resources for the <code>dev-team</code> user in the <code>dev</code> and <code>qa</code> namespace but deny access to any resources in any other namespace.</p>

<p>Create a ClusterRole (you could also create a Role in the <code>dev</code> and <code>qa</code> namespaces, but using a ClusterRole allows you to define the permissions only once and then reference it from multiple RoleBindings):</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: dev-team-users
rules:
- apiGroups:
    - '*'
  resources:
  - '*'
  verbs:
  - '*'
</code></pre>

<p>Create a RoleBinding in both the <code>dev</code> and <code>qa</code> namespaces:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: dev-team-user-bindings
  namespace: dev
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dev-team-users
subjects:
- kind: User
  name: dev-team
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: dev-team-user-bindings
  namespace: qa
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: dev-team-users
subjects:
- kind: User
  name: dev-team
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Test access:</p>

<pre><code>kubectl get pods -n qa --as=dev-team           # Succeeds
kubectl get pods -n dev --as=dev-team          # Succeeds
kubectl get pods -n default --as=dev-team      # Fails
kubectl get pods -n kube-system --as=dev-team  # Fails
</code></pre>

<p>See <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="noreferrer">Kubernetes RBAC documentation</a>.</p>

<h2>EDIT</h2>

<p><strong>1. Identify namespaces a user has created</strong></p>

<p>Can't do this with RBAC. You would need some form of <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="noreferrer">auditing</a>.</p>

<p><strong>2. Identify namespaces a user has access to</strong></p>

<p>Also can't do this easily with RBAC. But you could just iterate through all namespaces and test whether a given user has access:</p>

<pre class="lang-sh prettyprint-override"><code>for n in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
  echo -n "$n: "
  kubectl auth can-i get pods -n "$n" --as=dev-team
done
</code></pre>

<p>You can vary the verb/resource part (e.g. <code>get pods</code>) as needed.</p>
