<p>I have bunch of users. Every user should be able to create/change/delete substances in namespaces like <code>*-stage</code>. Namespaces can be added or removed dynamically. I can create ServiceAccount in every namespace and grant privileges.</p>

<p>I created pod in k8s and install kubectl and ssh into it. So every user has access to this pod and can use kubectl. I know that I can mount ServiceAccount secrets to pod. As far as I have different ServiceAccounts for every namespace I don't know how to grant privileges to all <code>*-stage</code> namespaces for every user. I don't want to create <code>cluster-admin</code> ClusterRoleBinding for ServiceAccount, cause users should be able to modify only <code>*-stage</code> namespaces. Can you help me please?</p>

Kirill Bugaev
<p>I am posting a community wiki answer based on OP's solution for better visibility:</p>

<blockquote>
  <p>Actually, I have already solved problem. I create <code>["*"]</code> role in every
  <code>*-stage</code> namespace and bind it to ServiceAccount. Then I mount ServiceAccount to kubectl pod which is available over ssh. So every
  user has unlimited access to <code>*-stage</code> namespaces.</p>
</blockquote>

<p>Also I am adding links for the official docs regarding <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="nofollow noreferrer">ServiceAccount</a> and <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">role-based access control</a> as a supplement. </p>
