<p>I'm trying to access deployments in another namespace, and have the following <code>ServiceAccount</code>, <code>ClusterRole</code>, and <code>ClusterRoleBinding</code></p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: tekton-triggers-example-sa
  namespace: tekton-pipelines
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    name: tekton-pipeline-sa
rules:
    - apiGroups: [&quot;&quot;]
      resources: [&quot;secrets&quot;, &quot;services&quot;, &quot;deployments&quot;, &quot;pods&quot;]
      verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;, &quot;create&quot;, &quot;delete&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: tekton-pipeline-permissions
    namespace: tekton-pipelines
subjects:
    - kind: ServiceAccount
      name: tekton-triggers-example-sa
      namespace: tekton-pipelines
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: tekton-pipeline-sa
</code></pre>
<p>With that I can get everything but <code>deployments</code></p>
<pre><code>kubectl auth can-i get secrets --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
yes
kubectl auth can-i get services --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
yes
kubectl auth can-i get deployments --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
no
kubectl auth can-i get pods --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
yes
</code></pre>
<p>If I delete the binding I can't get anything, which makes sense</p>
<pre><code>kubectl delete -f rbac/binding.yaml 
clusterrolebinding.rbac.authorization.k8s.io &quot;tekton-pipeline-permissions&quot; deleted

kubectl auth can-i get secrets --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
no
kubectl auth can-i get services --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
no
kubectl auth can-i get deployments --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
no
kubectl auth can-i get pods --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
no
</code></pre>
<p>If I apply it again, I get access to everything but <code>deployments</code></p>
<pre><code>kubectl apply -f rbac/binding.yaml 
clusterrolebinding.rbac.authorization.k8s.io/tekton-pipeline-permissions created
kubectl auth can-i get secrets --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
yes
kubectl auth can-i get services --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
yes
kubectl auth can-i get deployments --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
no
kubectl auth can-i get pods --as=system:serviceaccount:tekton-pipelines:tekton-triggers-example-sa -n anxiety-app 
yes
</code></pre>
<p>So that seems to me like that bindings is working for all the resources except <code>deployments</code>.</p>
<p>Anyone know what I've got wrong, why I can't access deployments?</p>

TMH
<p>Your ClusterRole should be:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tekton-pipeline-sa
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;secrets&quot;, &quot;services&quot;, &quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;, &quot;create&quot;, &quot;delete&quot;]
- apiGroups: [&quot;apps&quot;]
  resources: [&quot;deployments&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;, &quot;create&quot;, &quot;delete&quot;]
</code></pre>
<p>A Deployment would have some <code>apiVersion: apps/v1</code>. Which belongs to apiGroups <code>apps</code>. Wherehas pods, secrets or services would have theirs set to <code>v1</code>, thus in appGroups <code>&quot;&quot;</code>.</p>
