role binding : apiGroup definition instead of namespace about jiro HOT 3 OPEN

There is a difference between a clusterrolebinding and a rolebinding (as there is for role and clusterrole). A clusterrolebinding is not namespaced, ie it applies to the whole cluster, while a rolebinding is only about a specific namespace. It's very important to keep those a rolebinding and not clusterrolebinding and as such to keep the namespace part, otherwise you will grant permission to the whole cluster 😱

from jiro.

References:

• https://docs.openshift.com/container-platform/4.8/rest_api/rbac_apis/rolebinding-rbac-authorization-k8s-io-v1.html
• https://docs.openshift.com/container-platform/4.8/rest_api/rbac_apis/role-rbac-authorization-k8s-io-v1.html

@mbarbero do you know how the namespace attribute ended up there instead of the apiGroup attribute?

from jiro.

My bad, I read this one too quickly.

IIRC, namespace in roleref was something in the beta version of the RBAC API rbac.authorization.k8s.io/v1. It may still be accepted for backward compatibility reason.

Regarding apiGroups, the core one does not need to be specified (see https://kubernetes.io/docs/reference/using-api/#api-groups)

from jiro.