ClusterRoleBinding requires namespace

Question

I have the following:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: SomeServiceAccount

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: SomeClusterRole
rules:
  - apiGroups:
      - "myapi.com"
    resources:
      - 'myapi-resources'
    verbs:
      - '*'

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: SomeClusterRoleBinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: SomeClusterRole
subjects:
  - kind: ServiceAccount
    name: SomeServiceAccount

But it throws: The ClusterRoleBinding "SomeClusterRoleBinding" is invalid: subjects[0].namespace: Required value

I thought the whole point of "Cluster"RoleBinding is that it's not limited to a single namespace. Anyone can explain this?

Kubernetes version 1.13.12 Kubectl version v1.16.2 Thanks.

score 22 · Accepted Answer · answered Nov 18 '19 at 13:51

You are not required set a namespace while creating a ServiceAccount, the case here is that you are required to specify the namespace of your Service account when you refer to it while creating a ClusterRoleBinding to select it.

ServiceAccounts are namespace scoped subjects, so when you refer to them, you have to specify the namespace of the service account you want to bind. Source

In your case you can just use default namespace while creating your ClusterRoleBinding for example.

By doing this you are not tieing your ClusterRoleBinding to any namespace, as you can see in this example.

$ kubectl get clusterrolebinding.rbac.authorization.k8s.io/tiller -o yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"name":"tiller"},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"cluster-admin"},"subjects":[{"kind":"ServiceAccount","name":"tiller","namespace":"kube-system"}]}
  creationTimestamp: "2019-11-18T13:47:59Z"
  name: tiller
  resourceVersion: "66715"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/tiller
  uid: 085ed826-0a0a-11ea-a665-42010a8000f7
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: kube-system

score 5 · Answer 2 · answered Feb 20 '20 at 20:12

A kubernetes service account is scoped to a namespace. If you don't specify the namespace while creating the service account, your service account gets created in the 'default' namespace.

This allows you to create service accounts with the same name in different namespaces. i.e. All the namespaces have a service account named "default" when the namespace gets created.

To create service account in a namespace:

kubectl create serviceaccount my-sa -n my-namespace

The namespaces you have to put in the subject here refers to "where the service account is" and not "which namespaces this cluster role binding binds the resource access to".

score 3 · Answer 3 · answered Nov 15 '19 at 14:16

The cluster-wide aspect of a ClusterRole is that the resources in the rules are cluster-wide. For example, you could use a ClusterRole to give a subject get access to all Pods in all namespaces. With a Role, you could only give a subject get access to Pods in specific namespaces.

The cluster-wide aspect of a ClusterRoleBinding does not apply in any way to the subjects of the binding. In your example, you cannot create a binding for all service accounts with a particular name in all namespaces.

score 0 · Answer 4 · answered Nov 15 '19 at 12:27

Indeed, you're right, the ClusterRoleBinding should not be tied to a namespace, but I think the Subject may be tied or not (that's what the error says). You can debug this by checking the Kubernetes API spec for your specific version.

For example here, on the subject's namespace, it says: If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.

ClusterRoleBinding requires namespace

4 Answers4

Linked