<p>I am trying to attach a clusterrole and a role to a service account in kubernetes so I can limit certain actions to a namespace. When I do this it seems to apply only the cluster role permissions.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    meta.helm.sh/release-name: par
    meta.helm.sh/release-namespace: par
  creationTimestamp: &quot;2023-04-10T01:41:20Z&quot;
  labels:
    app.kubernetes.io/instance: par
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: chart
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: chart-0.1.0
  name: par-chart-manager-role
  resourceVersion: &quot;180751&quot;
  uid: 201f10e1-81c1-4c15-bd0c-4819caf37b64
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - pods
  - services
  verbs:
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - deployments
  verbs:
  - create
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - dns.par.dev
  resources:
  - arecords
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - dns.par.dev
  resources:
  - arecords/finalizers
  verbs:
  - update
- apiGroups:
  - dns.par.dev
  resources:
  - arecords/status
  verbs:
  - get
  - patch
  - update


kind: ClusterRoleBinding
metadata:
  annotations:
    meta.helm.sh/release-name: par
    meta.helm.sh/release-namespace: par
  creationTimestamp: &quot;2023-04-10T01:41:20Z&quot;
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: par
    app.kubernetes.io/instance: par
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: chart
    app.kubernetes.io/part-of: par
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: chart-0.1.0
  name: par-chart-manager-rolebinding
  resourceVersion: &quot;180754&quot;
  uid: 99d47f21-a2c9-445b-b3f3-0bb7c8bca4fe
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: par-chart-manager-role
subjects:
- kind: ServiceAccount
  name: par-chart-controller-manager
  namespace: par




apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  annotations:
    meta.helm.sh/release-name: par
    meta.helm.sh/release-namespace: par
  creationTimestamp: &quot;2023-04-10T01:41:20Z&quot;
  labels:
    app.kubernetes.io/instance: par
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: chart
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: chart-0.1.0
  name: par-chart-manager-role
  namespace: par
  resourceVersion: &quot;180757&quot;
  uid: b51cbbae-20f7-4927-b7bb-1e654f2f4d53
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - configmaps
  - secrets
  verbs:
  - get
  - list
  - patch
  - update
  - watch

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  annotations:
    meta.helm.sh/release-name: par
    meta.helm.sh/release-namespace: par
  creationTimestamp: &quot;2023-04-10T01:41:20Z&quot;
  labels:
    app.kubernetes.io/component: rbac
    app.kubernetes.io/created-by: par
    app.kubernetes.io/instance: par
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: chart
    app.kubernetes.io/part-of: par
    app.kubernetes.io/version: 0.1.0
    helm.sh/chart: chart-0.1.0
  name: par-chart-manager-rolebinding
  namespace: par
  resourceVersion: &quot;180758&quot;
  uid: 151148e3-7191-4ef2-bccc-97bd26fd724b
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: par-chart-manager-role
subjects:
- kind: ServiceAccount
  name: par-chart-controller-manager
  namespace: par

</code></pre>
<p>Permissions of Service account.</p>
<pre><code>$ kubectl auth can-i --list --as=system:serviceaccount:par:par-chart-controller-manager
Resources                                       Non-Resource URLs                     Resource Names   Verbs
arecords.dns.par.dev                            []                                    []               [create delete get list patch update watch]
deployments.apps                                []                                    []               [create get list patch update watch]
selfsubjectaccessreviews.authorization.k8s.io   []                                    []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                                    []               [create]
arecords.dns.par.dev/status                     []                                    []               [get patch update]
                                                [/.well-known/openid-configuration]   []               [get]
                                                [/api/*]                              []               [get]
                                                [/api]                                []               [get]
                                                [/apis/*]                             []               [get]
                                                [/apis]                               []               [get]
                                                [/healthz]                            []               [get]
                                                [/healthz]                            []               [get]
                                                [/livez]                              []               [get]
                                                [/livez]                              []               [get]
                                                [/openapi/*]                          []               [get]
                                                [/openapi]                            []               [get]
                                                [/openid/v1/jwks]                     []               [get]
                                                [/readyz]                             []               [get]
                                                [/readyz]                             []               [get]
                                                [/version/]                           []               [get]
                                                [/version/]                           []               [get]
                                                [/version]                            []               [get]
                                                [/version]                            []               [get]
pods                                            []                                    []               [list watch]
services                                        []                                    []               [list watch]
arecords.dns.par.dev/finalizers                 []                                    []               [update]
</code></pre>

jmcgrath207
<p>By default the kubernetes will list the clusterrolebindings without the <code>-n</code> flag in the <code>kubectl auth can-i</code> command. So try giving the namespace flag <code>-n</code> to check the <strong>rolebindings</strong> for <strong>serviceaccount</strong> in that particular namespace.</p>
<p>In your case the command looks like this:</p>
<pre><code>$Kubectl auth can-i –list –as-system:serviceaccount:par:par-chart-controller-manager -n par
</code></pre>
<p>You can check which rolebindings and clusterrolebindings are assigned to</p>
<pre><code>$ kubectl get rolebindings,clusterrolebindings -o wide -n &lt;namespace&gt; | grep &lt;serviceaccount name&gt;
</code></pre>
