<p>I have a group of service accounts in namespace <code>prometheus</code> and I have a cluster role for reading all pods in my cluster. How can I build <code>ClusterRoleBinding</code> to do it?</p>

faoxis
<p>If you go to <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">K8s docs about Using RBAC Authorization</a></p>
<p>And scroll down to examples, you can see this one:</p>
<blockquote>
<p>For all service accounts in the &quot;qa&quot; namespace:</p>
<pre><code>subjects:
- kind: Group
  name: system:serviceaccounts:qa
  apiGroup: rbac.authorization.k8s.io
</code></pre>
</blockquote>
<hr />
<p>You can now take it and apply to your usecase:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: &lt;some-fancy-name&gt;
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: &lt;clusterrolename&gt;
subjects:
- kind: Group
  name: system:serviceaccounts:prometheus
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<hr />
<p>There is also one different example worth to notice:</p>
<blockquote>
<ol start="3">
<li>Grant a role to all service accounts in a namespace</li>
</ol>
<p>If you want all applications in a namespace to have a role, no matter
what service account they use, you can grant a role to the service
account group for that namespace.</p>
<p>For example, grant read-only permission within &quot;my-namespace&quot; to all
service accounts in that namespace:</p>
<pre><code>kubectl create rolebinding serviceaccounts-view \
  --clusterrole=view \
  --group=system:serviceaccounts:my-namespace \
  --namespace=my-namespace
</code></pre>
</blockquote>
