<p>I am trying to workaround an issue with a third party tool.  That tool needs to be able to ensure that the namespace I tell it to work in exists.  To do that, it runs:</p>
<pre><code>kubectl get namespace my-namespace-name-here
</code></pre>
<p>The user that I let the third party tool run as has <code>edit</code> permissions in the <code>my-namespace-name-here</code> namespace.  (Via a <code>rolebinding</code> to the namespace using the <code>clusterrole</code> called <code>edit</code>.)</p>
<p>But edit permissions is not enough to allow it to check (using that command) if the namespace exists.</p>
<p>Ideally, I would like a way to grant the user permissions to just get the one namespace above.  But I would be satisfied if I could grant permissions to just list namespaces and nothing else new at the cluster level.</p>
<p><strong>How can I just add permissions to list namespaces?</strong></p>

Vaccano
<p>I figured it out!</p>
<p>I needed to make a <code>Role</code> scoped to <code>my-namespace-name-here</code> that grants the ability to get namespaces.  Then make a <code>rolebinding</code> to grant that permission to my user.  Running a <code>kubectl apply -f  ./my-yaml-file-below.yaml</code> did it.</p>
<p>Here is the yaml</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:  
  name: namespace-reader
  namespace: my-namespace-name-here
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;namespaces&quot;]
  verbs: [&quot;get&quot;]
---
apiVersion: &quot;rbac.authorization.k8s.io/v1&quot;
kind: RoleBinding
metadata:
  name: my-username-here-namespace-reader
  namespace: my-namespace-name-here
roleRef:
  apiGroup: &quot;rbac.authorization.k8s.io&quot;
  kind: Role
  name: namespace-reader
subjects:
  - apiGroup: &quot;rbac.authorization.k8s.io&quot;
    kind: User
    name: &quot;my-username-here@mydomain.com&quot;
</code></pre>
<p>This allows the user to do a <code>kubectl get namespace</code> only the the namespace that this is granted on.</p>
