<p>I'm trying to create one serviceaccount in Kubernetes with the same token and give them access only to three namespaces. Is this possible in Kubernetes?</p>

<p>What I have done:</p>

<p>I create my serviceaccount:</p>

<pre><code>kubectl create serviceaccount myuser
</code></pre>

<p>I Create a role:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: myrole
rules:
- apiGroups:
  - ""
  resources:
  - pods/attach
  - pods/exec
  - pods/portforward
  - pods/proxy
  - secrets
  - services/proxy
  verbs:
  - get
  - list
  - watch
</code></pre>

<p>I create a ClusterRoleBinding</p>

<pre><code>kind: ClusterRoleBinding
metadata:
  labels:
  name: myRoleBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: myrole
subjects:
- kind: ServiceAccount
  name: myuser
  namespace: wordpress
- kind: ServiceAccount
  name: myuser
  namespace: mysql
- kind: ServiceAccount
  name: myuser
  namespace: redis
</code></pre>

<p>I trying to get <strong>secrets</strong> in the namespace wordpress but get this:</p>

<pre><code>Error from server (Forbidden): pods is forbidden: User
"system:serviceaccount:default:myuser" cannot list resource "secrets" in API group
 "" in the namespace "wordpress"
</code></pre>

<p>Hope someone can help here.</p>

user11613128
<p>You want to bind that clusterrole to the service account in all three namespaces. To do this, create a namespaced rolebinding in each namespace.</p>

<p>i.e.</p>

<pre><code>$ kubectl create rolebinding myrolebinding --serviceaccount=default:myuser --clusterrole=myrole --namespace=wordpress

$ kubectl create rolebinding myrolebinding --serviceaccount=default:myuser --clusterrole=myrole --namespace=namespace2

$ kubectl create rolebinding myrolebinding --serviceaccount=default:myuser --clusterrole=myrole --namespace=namespace3
</code></pre>
