<p>I am trying to create a namespace in an AWS EKS cluster and keep getting an error.</p>
<p>I can do everything I want using the default namespace yet when I try to create a new namespace name I am forbidden.</p>
<p>It must be something that I have done incorrectly with the user &quot;thera-eks&quot;.
Perhaps the role binding?</p>
<p>It looks like I gave the role access to everything since in the rules I gave it the * wildcard.</p>
<p>The command I use is -</p>
<pre><code>kubectl create namespace ernie
</code></pre>
<p>The error I get is -</p>
<pre><code>Error from server (Forbidden): namespaces is forbidden: User &quot;thera-eks&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope
</code></pre>
<p>My role.yaml is:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: full_access
rules:
- apiGroups: [&quot;*&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
</code></pre>
<p>My rolebinding.yaml is:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: full_access_role_binding
subjects:
- kind: User
  name: thera-eks
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: full_access
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>The aws-auth config map is:</p>
<pre><code>data:
  mapRoles: |
    - groups:
      - system:bootstrappers
      - system:nodes
      rolearn: arn:aws:iam::9967xxxxxxxx:role/eksctl-ops-nodegroup-linux-ng-sys-NodeInstanceRole-346VJPTOXI7L
      username: system:node:{{EC2PrivateDNSName}}
    - groups:
      - eks-role
      - system:master
      rolearn: arn:aws:iam::9967xxxxxxxx:role/thera-eks
      username: thera-eks
  mapUsers: |
    - userarn: arn:aws:iam::9967xxxxxxxx:user/test-ecr
    username: test-ecr
    groups:
    - eks-role
</code></pre>
<p>The AWS IAM permissions JSON for the role &quot;thera-eks&quot; is -</p>
<pre><code> {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;ecr:BatchGetImage&quot;,
                &quot;ecr:BatchCheckLayerAvailability&quot;,
                &quot;ecr:CompleteLayerUpload&quot;,
                &quot;ecr:DescribeImages&quot;,
                &quot;ecr:DescribeRepositories&quot;,
                &quot;ecr:GetDownloadUrlForLayer&quot;,
                &quot;ecr:InitiateLayerUpload&quot;,
                &quot;ecr:ListImages&quot;,
                &quot;ecr:PutImage&quot;,
                &quot;ecr:UploadLayerPart&quot;,
                &quot;ecr:GetAuthorizationToken&quot;
            ],
            &quot;Resource&quot;: &quot;*&quot;
        },
        {
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;eks:*&quot;,
                &quot;iam:ListRoles&quot;,
                &quot;sts:AssumeRole&quot;
            ],
            &quot;Resource&quot;: &quot;*&quot;
        }
    ]
}
</code></pre>

ErnieAndBert
<p>@mdaniel and @PEkambaram are right but I would like to expand and back it up with the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">official docs</a> for better understanding:</p>
<blockquote>
<p>An <code>RBAC</code> <code>Role</code> or <code>ClusterRole</code> contains rules that represent a set
of permissions. Permissions are purely additive (there are no &quot;deny&quot;
rules).</p>
<p>A <code>Role</code> always sets permissions within a particular namespace; when
you create a <code>Role</code>, you have to specify the namespace it belongs in.</p>
<p><code>ClusterRole</code>, by contrast, is a non-namespaced resource. The
resources have different names (<code>Role</code> and <code>ClusterRole</code>) because a
Kubernetes object always has to be either namespaced or not
namespaced; it can't be both.</p>
<p><code>ClusterRoles</code> have several uses. You can use a <code>ClusterRole</code> to:</p>
<ul>
<li><p>define permissions on namespaced resources and be granted within individual namespace(s)</p>
</li>
<li><p>define permissions on namespaced resources and be granted across all namespaces</p>
</li>
<li><p>define permissions on cluster-scoped resources</p>
</li>
</ul>
<p><strong>If you want to define a role within a namespace, use a <code>Role</code>; if you want to define a role cluster-wide, use a <code>ClusterRole</code>.</strong></p>
</blockquote>
<p>You will also find an example of a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrole-example" rel="nofollow noreferrer">ClusterRole</a>:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  # &quot;namespace&quot; omitted since ClusterRoles are not namespaced
  name: secret-reader
rules:
- apiGroups: [&quot;&quot;]
  #
  # at the HTTP level, the name of the resource for accessing Secret
  # objects is &quot;secrets&quot;
  resources: [&quot;secrets&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
</code></pre>
<p>and for a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrolebinding-example" rel="nofollow noreferrer">ClusterRoleBinding</a>:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
# This cluster role binding allows anyone in the &quot;manager&quot; group to read secrets in any namespace.
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: manager # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>The linked docs will show you all the necessary details with examples that would help understand and setup your RBAC.</p>
