# Restrict specific service account in a namespace

**URL:** <https://discuss.kubernetes.io/t/restrict-specific-service-account-in-a-namespace/10797>\
**Category:** General Discussions\
**Created:** [May 6, 2020, 4:58pm UTC](https://discuss.kubernetes.io/t/restrict-specific-service-account-in-a-namespace/10797 "2020-05-06T16:58:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vijay1994](https://avatars.discourse-cdn.com/v4/letter/v/7993a0/32.png) [@vijay1994](https://discuss.kubernetes.io/u/vijay1994)\
**Post date:** [May 6, 2020, 4:58pm UTC](https://discuss.kubernetes.io/t/restrict-specific-service-account-in-a-namespace/10797/1 "2020-05-06T16:58:54Z")

</div>

Kubernetes version: 1.18  
Cloud being used: bare-metal  
Installation method:  
Host OS: OS centos

We have a use case where we want to assign a specific pod within a namespace to a different psp and all the other pods within the same namespace to a different psp. May I know the way where we can create role bindings for the restricted service account?

For example in namespace abc we have 10 pods deployed and in that one pod has root access. So we have created 2 psp , one restricts the deployment of pods which has root access and the other psp that deploys pods which doesnt have root access. We are deploying all the 10 pods within the same namespace but 1 pod has root access and the other 9 doesnt have.

In the above scenario, instead of defining 2 role binding file, is there a way where I can mention like restrict a service account within this namespace inside the subjects section?

You can format your yaml by highlighting it and pressing Ctrl-Shift-C, it will make your output easier to read.

---

<div class="post-metadata">

**Author:** ![shaik\_zillani](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@shaik\_zillani](https://discuss.kubernetes.io/u/shaik_zillani)\
**Post date:** [February 24, 2021, 2:13pm UTC](https://discuss.kubernetes.io/t/restrict-specific-service-account-in-a-namespace/10797/2 "2021-02-24T14:13:31Z")

</div>

I’m giving an example here,  
scenario: restricts specific resources in a specific namespace, let’s say I want to  
allow only daemonsets in qa namespace.

```auto
kubectl create ns qa
kubectl create sa test-user -n qa

```

create clusterrole and rolebinding,

```auto
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
   name: test-namespace-role
   namespace: qa
rules:
 - apiGroups: ["*"]
   resources: ["daemonsets"]
   verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
   name: test-namespace-only
   namespace: qa
subjects:
 - kind: ServiceAccount
   name: test-user
   namespace: qa
roleRef:
   kind: ClusterRole
   name: test-namespace-role
   apiGroup: rbac.authorization.k8s.io

```

deploy it,

```auto
kubectl apply -f <config> -n qa

```

Generate a token,

```auto
TOKEN=$(kubectl describe secrets "$(kubectl describe sa test-user -n qa | grep -i Tokens | awk '{print $2}')" -n qa| grep token: | awk '{print $2}')
echo $TOKEN

```

That’s it! now let’s verify using kubeconfig,

```auto
kubectl config set-context test-user --cluster=docker-desktop --user=test-user 
kubectl config set-credentials test-user --token=$TOKEN
kubectl config use-context test-user 

```

Test using kubectl,

```auto
kubectl get pods 
kubectl get pods -n test
kubectl get cm -n test

```