<p>I want to set a serviceaccount authorizations by associating it to a clusterRole but restricted to a namespace using a rolebinding.</p>

<p>I declared one clusterrole and I configured a rolebinding in a namespace pointing to that clusterrole. 
However when I access the cluster with the serviceaccount token defined in the rolebinding I'm not restricted to the namespace.<br>
On the other hand, when I'm accessing the cluster with a "User" certificate, this is working. I have only access to the namespace.</p>

<p>Kubernetes v1.13.5</p>

<p>The Rolebinding I defined:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: exploitant
  namespace: myNamespace
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- kind: ServiceAccount
  name: default
  namespace: myNamespace
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: myUser
</code></pre>

<p>This is what I get:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl auth can-i --token=XXXXXXXX get po -n myNamespace
yes
</code></pre>

<p>--> as expected</p>

<pre class="lang-sh prettyprint-override"><code>kubectl auth can-i --token=XXXXXXXX get po -n kube-system
yes
</code></pre>

<p>--> not expected !!!</p>

Julien Le Fur
<p>The solution is to create a specific ServiceAccount. The "default" serviceAccount should not be used. By default all pods run with the default service account (if you dont specify one). So, the default service account exist in all namespace, so default service account can read pods in all namespace. </p>
