title: K8s RBAC serviceaccount with extended permissions
body: <p>I am looking for option to have serviceaccount  (which is not cluster admins) to be able to create new namespace and automatically get admin permission on it (while all system namespaces are not editable by this serviceaccount).</p>
  
  <p>Currently my serviceaccount binded to clusterrole contains </p>
  
  <pre><code>- apiGroups:
    - ""
    resources:
    - namespaces
    verbs:
    - create
  </code></pre>
  
  <p>However it can't do anything on namespace it creates.
  Would like to get any suggestions, recommendations.</p>