<p>I created a new service account and a rolebining giving him the role of cluster-admin as follows. I applied a new CRD resource with it and I expected it to fail as the default cluster-admin role can not manage CRD unless a new ClusterRole is created with aggregate-to-admin label, but the CRD was created and I do not understand why.</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles</a></p>
<p>kubectl create -f new_crd.yaml --as=system:serviceaccount:test-ns:test</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-rolebinding
subjects:
- kind: ServiceAccount
  name: test
  namespace: test-ns
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
</code></pre>

Revital Eres
<p>Addressing the part of the last comment:</p>
<blockquote>
<p>I do not understand the purpose of using aggregate-to-admin label -- I thought its purpose is to add rules to cluster-admin but if cluster-admin can do anything in the first place then why it is used?</p>
</blockquote>
<p><code>aggregate-to-admin</code> is a <code>label</code> used to aggregate <code>ClusterRoles</code>. This exact is used to aggregate <code>ClusterRoles</code> to an <strong><code>admin</code></strong> <code>ClusterRole</code>.</p>
<blockquote>
<p>A side note!</p>
<p><code>cluster-admin</code> and <code>admin</code> are two separate <code>ClusterRoles</code>.</p>
</blockquote>
<p>I will include the example of aggregating <code>ClusterRoles</code> with an explanation below.</p>
<p>You can read in the official Kubernetes documentation:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Default ClusterRole</th>
<th>Default ClusterRoleBinding</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>cluster-admin</td>
<td>system:masters group</td>
<td>Allows super-user access to perform any action on any resource. When used in a ClusterRoleBinding, it gives full control over every resource in the cluster and in all namespaces. When used in a RoleBinding, it gives full control over every resource in the role binding's namespace, including the namespace itself.</td>
</tr>
<tr>
<td>admin</td>
<td>None</td>
<td>Allows admin access, intended to be granted within a namespace using a RoleBinding. If used in a RoleBinding, allows read/write access to most resources in a namespace, including the ability to create roles and role bindings within the namespace. This role does not allow write access to resource quota or to the namespace itself.</td>
</tr>
<tr>
<td></td>
<td></td>
<td></td>
</tr>
</tbody>
</table>
</div>
<ul>
<li><em><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: Access authn authz: RBAC: User facing roles</a></em></li>
</ul>
<hr />
<h3>Using aggregated <code>ClusterRoles</code></h3>
<p>The principle behind aggregated <code>Clusterroles</code> is to have one <code>ClusterRole</code> that have multiple other <code>ClusterRoles</code> aggregated to it.</p>
<p>Let's assume that:</p>
<ul>
<li>A <code>ClusterRole</code>: <code>aggregated-clusterrole</code> will be aggregating two other <code>ClusterRoles</code> that will have needed permissions on some actions.</li>
<li>A <code>ClusterRole</code>: <code>clusterrole-one</code> will be used to add some permissions to <code>aggregated-clusterrole</code></li>
<li>A <code>ClusterRole</code>: <code>clusterrole-two</code> will be used to add some permissions to <code>aggregated-clusterrole</code></li>
</ul>
<p>An example of such setup could be implemented by <code>YAML</code> definitions like below:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: aggregated-clusterrole
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.example.com/put-here-any-label-name: &quot;true&quot; # &lt;-- IMPORTANT
rules: [] 
</code></pre>
<p>Above definition will be aggregating <code>ClusterRoles</code> created with a <code>label</code>:</p>
<ul>
<li><code>rbac.example.com/put-here-any-label-name: &quot;true&quot;</code></li>
</ul>
<p>Describing this <code>ClusterRole</code> without aggregating any <code>ClusterRoles</code> with previously mentioned <code>label</code>:</p>
<ul>
<li><code>$ kubectl describe clusterrole aggregated-clusterrole</code></li>
</ul>
<pre class="lang-sh prettyprint-override"><code>Name:         aggregated-clusterrole
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
</code></pre>
<p>Two <code>ClusterRoles</code> that will be used are the following:</p>
<p><code>clusterrole-one.yaml</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: clusterrole-one
  labels:
    rbac.example.com/put-here-any-label-name: &quot;true&quot; # &lt;-- IMPORTANT
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
</code></pre>
<p><code>clusterrole-two.yaml</code>:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: clusterrole-two
  labels:
    rbac.example.com/put-here-any-label-name: &quot;true&quot; # &lt;-- IMPORTANT
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;services&quot;]
  verbs: [&quot;create&quot;, &quot;delete&quot;]
</code></pre>
<p>After applying above definitions, you can check if <code>aggregated-clusterrole</code> have permissions used in <code>clusterrole-one</code> and <code>clusterrole-two</code>:</p>
<ul>
<li><code>$ kubectl describe clusterrole aggregated-clusterrole</code></li>
</ul>
<pre class="lang-sh prettyprint-override"><code>Name:         aggregated-clusterrole
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  services   []                 []              [create delete]
  pods       []                 []              [get list watch]
</code></pre>
<hr />
<p>Additional resources:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: Access authn authz: RBAC</a></em></li>
</ul>
