<p>I created a namespace <code>xxx</code>; the role for this namespace is to get pods, services, etc. I created a service account <code>yyy</code> and a role binding <code>yyy</code> to the role in namespace <code>xxx</code>.</p>

<p>When I try to check something through the API with a secret token, for example</p>

<pre><code>curl -kD - -H "Authorization: Bearer $TOKEN https://localhost:6443/api/v1/namespaces/xxx/pods
</code></pre>

<p>I get a "403 forbidden" error.</p>

<p>So I a cluster role binding of my service account <code>yyy</code> to cluster role <code>view</code>, and after that of course a user can see pods of my namespace, but can see other pods from other namespaces too.</p>

<p>How can I restrict service account <code>yyy</code> tee see pods, services, etc. only from a specific namespace?</p>

kris
<p>To allow access only in a specific namespace create a rolebinding, not a clusterrolebinding:</p>

<p><code>kubectl create rolebinding my-viewer --clusterrole=view --serviceaccount=xxx:yyy -n xxx</code></p>
