<p>I have a cron that's I'm testing for another project that is supposed to delete a namespace called &quot;test&quot; every minute.</p>
<p>I have set up a ServiceAccount, ClusterRole, and RoleBinding as shown below:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: test
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;namespaces&quot;]
  verbs: [&quot;delete&quot;, &quot;get&quot;, &quot;list&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test # This will bind the role and service account
subjects:
- kind: ServiceAccount
  name: test
roleRef:
  kind: ClusterRole
  name: test
  apiGroup: rbac.authorization.k8s.io

</code></pre>
<p>My Cronjob is as follows:</p>
<pre><code>apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: kill-ns
spec:
  schedule: &quot;*/1 * * * *&quot;
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: test
          containers:
          - name: kill-ns
            image: bitnami/kubectl:latest
            command:
            - kubectl
            args:
            - delete
            - namespace
            - test
          restartPolicy: Never
</code></pre>
<p>I get the following error on from the job.</p>
<blockquote>
<p>Error from server (Forbidden): namespaces &quot;test&quot; is forbidden: User
&quot;system:serviceaccount:default:test&quot; cannot delete resource
&quot;namespaces&quot; in API group &quot;&quot; in the namespace &quot;test&quot;</p>
</blockquote>
<p>I thought my apiGroups was the issue it was not. apiGroups is [&quot;&quot;] for namespaces.</p>
<p>I'm currently using docker desktop locally.</p>
<p>Edit: I am deploying the job in the default namespace.</p>

TeeTee
<p>You have to use ClusterRoleBinding instead of RoleBinding. RoleBinding only allows access to resources in the namespace of the service account while ClusterRoleBinding allows cluster-wide access.</p>
