<p>When I type <code>kubectl edit clusterrolebinding foo-role</code>, I can see something like:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: foo-role
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects:
- kind: ServiceAccount
  name: foo-user
  namespace: ns1
- kind: ServiceAccount
  name: foo-user
  namespace: ns2
</code></pre>

<p>I can add a new <code>ClusterRoleBinding</code> for namespace <code>ns3</code> by appending the following config to above file:</p>

<pre class="lang-yaml prettyprint-override"><code>- kind: ServiceAccount
  name: foo-user
  namespace: ns3
</code></pre>

<p>However, I want to use Kustomize to add new bindings instead of manually modifying the above file.</p>

<p>I tried to apply the .yaml file below:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: foo-role
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/foo-role
  uid: 64a4a787-d5ab-4c83-be2b-476c1bcb6c96
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects:
- kind: ServiceAccount
  name: foo-user
  namespace: ns3
</code></pre>

<p>It did add a new <code>ClusterRoleBinding</code> in the namespace <code>ns3</code>, but it will remove existing <code>ClusterRoleBinding</code>s for <code>ns1</code> and <code>ns2</code>.</p>

<p>Is there a way to add new <code>ClusterRoleBinding</code> with Kustomize without removing existing ones?</p>

johnlinp
<p>Give them different names in the metadata. You didn't make a new one, you just overwrote the same one.</p>
