<p>Is their a way to create a ClusterRole using ClusterRolebinding that can provide permissions to create ClusterRoles/ClusterRolebindings and also add a condition somehow it can be limited to one namespace and cannot create resources in other namespaces?</p>
<p>Since, ClusterRole and ClusterRolebinding are not namespaced I'm looking for a way specifically for a way to provide permissions to create ClusterRole and ClusterRolebinding and then limit other resource creation specific to a namespace.</p>
<p>This cannot be achieved with RoleBinding since, it can only limit to namespace and cannot provide the permissions to create the non-namespaced resources.</p>

3br10ee032
<p>From what I understand this is what you want to achieve:</p>
<ol>
<li>You have a cluster admin access</li>
<li>You want to use this cluster admin access to create namespace admin(s)</li>
<li>You want these namespace admins to be able to grant access to other subject (e.g. users, groups or service accounts) to resources in that namespace.</li>
</ol>
<p>If yes, then here is something you can try.</p>
<p>By default, your Kubernetes cluster comes with a set of default <code>ClusterRole</code> objects. In particular there are two default cluster roles that you will focus on:</p>
<ol>
<li>edit</li>
<li>admin</li>
</ol>
<p>Binding <code>edit</code> cluster role to a subject either by using <code>RoleBinding</code> or <code>ClusterRoleBinding</code> gives the subject access to edit most common resources like pods, deployments, secrets etc.</p>
<p>The <code>admin</code> cluster role however contains the accesses contained by the <code>edit</code> cluster role as well as accesses to additional namespaced resources, in particular to two resources that would be useful to administer a namespace:</p>
<ol>
<li>Role</li>
<li>RoleBinding</li>
</ol>
<p>If you bind this <code>admin</code> cluster role using <code>RoleBinding</code> to a subject within a specific namespace, you effectively give that subject the capabilities to administer the namespace, including creating another <code>RoleBinding</code> within that namespace to give some other subjects accesses to that namespace.</p>
<p>To illustrate:</p>
<pre><code>You --(RoleBinding to admin ClusterRole)--&gt; NamespaceAdmin
NamespaceAdmin --(RoleBinding to some Role or ClusterRole)--&gt; OtherSubjects
</code></pre>
<p>Since <code>RoleBinding</code> is restricted to a specific namespace, the namespace admin will only have the <code>admin</code> accesses within that namespace only and cannot wreck havoc in other namespaces or at cluster level.</p>
