<p>I'm deploying my chart with helm like this:</p>
<pre><code>helm upgrade --install --namespace newnamespace --create-namespace testing mychart
</code></pre>
<p>My understanding is everything should be deployed into <code>newnamespace</code></p>
<p>I have this in my chart:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include &quot;mychart.serviceAccountName&quot; . }}

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: {{ include &quot;mychart.serviceAccountName&quot; . }}
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;services&quot;,&quot;endpoints&quot;,&quot;pods&quot;]
  verbs: [&quot;get&quot;,&quot;watch&quot;,&quot;list&quot;]
- apiGroups: [&quot;extensions&quot;,&quot;networking.k8s.io&quot;]
  resources: [&quot;ingresses&quot;] 
  verbs: [&quot;get&quot;,&quot;watch&quot;,&quot;list&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;nodes&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: {{ include &quot;mychart.serviceAccountName&quot; . }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include &quot;mychart.serviceAccountName&quot; . }}
subjects:
- kind: ServiceAccount
  name: {{ include &quot;mychart.serviceAccountName&quot; . }}
</code></pre>
<p>When deployed I get this error:</p>
<pre><code>Error: ClusterRoleBinding.rbac.authorization.k8s.io &quot;my-service-account&quot; is invalid: subjects[0].namespace: Required value
</code></pre>
<p>Then I add this and the deploy works:</p>
<pre><code>...
    subjects:
    - kind: ServiceAccount
      name: {{ include &quot;mychart.serviceAccountName&quot; . }}
      namespace: {{ .Release.Namespace }}
</code></pre>
<p>Why is this? What is this requirement of ClusterRoleBinding? I can't it see the namespace where it's being deployed?</p>
<p>Is it because ClusterRoleBinding is cluster wide it <em>must</em> have the namespace defined in its definition? Are ClusterRoleBinding resources not created in any namespaces? If so where do they live kube-system?</p>
<p>Does this mean that if I deleted the namespace containing my helm release before doing a helm uninstall the ClusterRoleBinding would be left behind?</p>

red888
<p><code>ClusterRoleBinding</code> binds the <code>ClusterRole</code> with you service account. <code>ClusterRoleBinding</code> gives the access in cluster-wide. In cluster role you basically tell that what actions can your service account perform. A ClusterRole is a set of permissions that can be assigned to resources within a given cluster.</p>
<p>Now by <code>ClusterRoleBinding</code> you are just binding the <code>ClusterRole</code> with your service account, as service account is a namespace scoped object so you must need to provide the namespace name in your subject as you did in the second part.</p>
<p>btw, <code>ClusterRole</code> is a non-namespaced resource. As far the k8s docs, you can use a <code>ClusterRole</code> to:</p>
<ul>
<li>define permissions on namespaced resources and be granted within individual namespace(s)</li>
<li>define permissions on namespaced resources and be granted across all namespaces</li>
<li>define permissions on cluster-scoped resources</li>
</ul>
<p>Another thing will also work is adding the <code>apiGroup</code> like <code>  apiGroup: rbac.authorization.k8s.io</code>.</p>
<p>When you created <code>service account</code> you created in basically in <code>default</code> namespace as it is the default thing, here:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include &quot;mychart.serviceAccountName&quot; . }}
</code></pre>
<p>As your last question, <code>ClusterRole</code> is cluster-scoped but <code>ClusterRoleBinding</code> and <code>service account</code> is namespace scoped and as far the rules if you delete a namespace then all the object of that namespace will be gone along with the namespace.</p>
<p>You can see the k8s <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-binding-examples" rel="nofollow noreferrer">doc</a> for getting more clear idea.</p>
<p>I found another good <a href="https://octopus.com/blog/k8s-rbac-roles-and-bindings" rel="nofollow noreferrer">tuto</a></p>
