<p>Trying to write my first set of RBAC roles. So trying to figure out the best way to have 2 roles for multiple namespaced components.</p>

<p>Admin-role (RW for 3 namespaces say default, ns1 &amp; ns2)
user-role (Read-only for 3 namespaces say default, ns1 &amp; ns2)</p>

<p>Was thinking will need a service account with 2 clusterRoles for admin/user</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ServiceAccount
metadata:
  name: sa
  namespace: default

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: admin-master
rules:
- apiGroups:
    - batch
  resources:
    - pods
  verbs:
    - create
    - delete
    - deletecollection
    - get
    - list
    - patch
    - update
    - watch

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: user-master
rules:
- apiGroups:
    - batch
  resources:
    - pods
  verbs:
    - get
    - list
    - watch
</code></pre>

<p>Then make use of roleBindings:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: admin-rw
  namespace: ns1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin-master
subjects:
  - kind: ServiceAccount
    name: sa
    namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: user-readonly
  namespace: ns1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: user-master
subjects:
  - kind: ServiceAccount
    name: sa
    namespace: default
</code></pre>

<p>But not sure how the best way to bind roles admin-rw/user-readonly with namespace 2 (ns2)?</p>

daverocks
<p>Roles are scoped, either bound to an specific namespace or cluster-wide. For namespace-scoped roles, <a href="https://www.cncf.io/blog/2018/08/01/demystifying-rbac-in-kubernetes/" rel="nofollow noreferrer">you can just simply deploy the same role in multiple namespaces</a>.</p>

<p>The idea behind this is to have partitioned permissions in the cluster, although <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions" rel="nofollow noreferrer">it implies more administrative effort</a> but is a safer practice.</p>

<p>Additionally, in your definition, you're trying to bind permissions to specific namespaces, however, you're using <code>ClusterRole</code> which is a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">cluster-scoped resource</a>. You might want to change that to <code>Role</code> if you want namespace-scoped permissions.</p>

<p>You might find this <a href="https://www.cncf.io/blog/2018/08/01/demystifying-rbac-in-kubernetes/" rel="nofollow noreferrer">CNCF article</a> useful on this matter.</p>
