<p>I'm trying to lock down a namespace in kubernetes using <strong>RBAC</strong> so I followed this <a href="https://blog.viktorpetersson.com/2018/06/15/kubernetes-rbac.html" rel="nofollow noreferrer">tutorial</a>.<br>
I'm working on a <strong>baremetal cluster</strong> (no minikube, <strong>no cloud provider</strong>) and installed kubernetes using Ansible.</p>

<p>I created the folowing <strong>namespace :</strong></p>

<pre><code>apiVersion: v1
kind: Namespace
metadata:
  name: lockdown
</code></pre>

<p><strong>Service account :</strong></p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-lockdown
  namespace: lockdown
</code></pre>

<p><strong>Role :</strong></p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: lockdown
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: [""]
  verbs: [""]
</code></pre>

<p><strong>RoleBinding :</strong></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rb-lockdown
subjects:
- kind: ServiceAccount
  name: sa-lockdown
roleRef:
  kind: Role
  name: lockdown
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>And finally I tested the authorization using the next command</p>

<pre><code>kubectl auth can-i get pods --namespace lockdown --as system:serviceaccount:lockdown:sa-lockdown
</code></pre>

<p>This <strong>SHOULD</strong> be returning "No" but I got "Yes" :-(  </p>

<p>What am I doing wrong ?<br>
Thx</p>

Doctor
<p>I finally found what was the problem.  </p>

<p>The <em>role</em> and <em>rolebinding</em> <strong>must</strong> be created inside the targeted namespace.  </p>

<p>I changed the following role and rolebinding types by specifying the namespace inside the yaml directly.</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: lockdown
  namespace: lockdown
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - watch
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rb-lockdown
  namespace: lockdown
subjects:
- kind: ServiceAccount
  name: sa-lockdown
roleRef:
  kind: Role
  name: lockdown
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>In this example I gave permission to the user <strong>sa-lockdown</strong> to <strong><em>get</em>, <em>watch</em> and <em>list</em></strong> the <strong>pods</strong> in the namespace <strong>lockdown</strong>.</p>

<hr>

<p>Now if I ask to get the pods : <code>kubectl auth can-i get pods --namespace lockdown --as system:serviceaccount:lockdown:sa-lockdown</code> it will return <strong>yes</strong>.  </p>

<p>On the contrary if ask to get the deployments : <code>kubectl auth can-i get deployments --namespace lockdown --as system:serviceaccount:lockdown:sa-lockdown</code> it will return <strong>no</strong>.</p>

<hr>

<p>You can also leave the files like they were in the question and simply create them using <code>kubectl create -f &lt;file&gt; -n lockdown</code>.</p>
