<p>I am attempting to create service account that can create a CRD, but when I bind the service account to cluster-admin, kubernetes is telling me that it doesn't have permission</p>
<p>this is how I bind it</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-role-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: my-user
  namespace: my-namespace
</code></pre>
<p>and I've created the service account using:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-user
  namespace: my-namespace
</code></pre>
<p>but when I run <code>kubectl auth can-i create CustomResourceDefinition --as=my-user --all-namespaces</code> it returns <code>no</code>.</p>
<p>I'm failing to see how it does not permission to create CRD's</p>

Sam Reynolds
<p>Turns out you cannot specify just the name of the service account in the --as flag.</p>
<p>running <code>$ kubectl auth can-i create customresourcedefinition --as=system:serviceaccount:my-namespace:my-user</code> returns <code>yes</code></p>
<p>I was also trying to limit the CRD that the service account was allowed to create by using the <code>reosurceName</code> field, but apparently, you need access to <code>get, create</code> all CRD's in order to create a CRD even if you have all the permissions for the CRD with a specific <code>resourceName</code></p>
