title: RBAC: roles with multiple namespaces
body: <p>Trying to write my first set of RBAC roles. So trying to figure out the best way to have 2 roles for multiple namespaced components.</p>
  
  <p>Admin-role (RW for 3 namespaces say default, ns1 &amp; ns2)
  user-role (Read-only for 3 namespaces say default, ns1 &amp; ns2)</p>
  
  <p>Was thinking will need a service account with 2 clusterRoles for admin/user</p>
  
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1
  kind: ServiceAccount
  metadata:
    name: sa
    namespace: default
  
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: admin-master
  rules:
  - apiGroups:
      - batch
    resources:
      - pods
    verbs:
      - create
      - delete
      - deletecollection
      - get
      - list
      - patch
      - update
      - watch
  
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: user-master
  rules:
  - apiGroups:
      - batch
    resources:
      - pods
    verbs:
      - get
      - list
      - watch
  </code></pre>
  
  <p>Then make use of roleBindings:</p>
  
  <pre><code>apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: admin-rw
    namespace: ns1
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: admin-master
  subjects:
    - kind: ServiceAccount
      name: sa
      namespace: default
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: user-readonly
    namespace: ns1
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: user-master
  subjects:
    - kind: ServiceAccount
      name: sa
      namespace: default
  </code></pre>
  
  <p>But not sure how the best way to bind roles admin-rw/user-readonly with namespace 2 (ns2)?</p>