Aquí hay una solución que resuelve el problema, usando kustomize-v4.0.5 :

 cat <<EOF > kustomization.yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization patchesJson6902: - patch: |- - op: replace path: /kind value: RoleBinding - op: add path: /metadata/namespace value: <NAMESPACE> target: group: rbac.authorization.k8s.io kind: ClusterRoleBinding name: manager-rolebinding version: v1 resources: - role_binding.yaml - service_account.yaml namespace: <NAMESPACE> EOF cat <<EOF > role_binding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: manager-role subjects: - kind: ServiceAccount name: controller-manager namespace: system --- apiVersion: apps/v1 kind: Deployment metadata: name: controller-manager namespace: system spec: selector: matchLabels: control-plane: controller-manager replicas: 1 template: metadata: labels: control-plane: controller-manager spec: containers: - command: - /manager args: - --enable-leader-election image: controller:latest name: manager EOF cat <<EOF > service_account.yaml apiVersion: v1 kind: ServiceAccount metadata: name: controller-manager namespace: system EOF

Agregar el recurso ServiceAccount y el campo Namespace en el recurso RoleBinding permite establecer correctamente el campo de subject en RoleBinding .

Mirando directamente desde el código :

 // roleBindingHack is a hack for implementing the namespace transform // for RoleBinding and ClusterRoleBinding resource types. // RoleBinding and ClusterRoleBinding have namespace set on // elements of the "subjects" field if and only if the subject elements // "name" is "default". Otherwise the namespace is not set. // // Example: // // kind: RoleBinding // subjects: // - name: "default" # this will have the namespace set // ... // - name: "something-else" # this will not have the namespace set // ...

ServiceAccount y la referencia en ClusterRoleBinding deben tener "predeterminado" como espacio de nombres o, de lo contrario, no se reemplazará.

Revisa el ejemplo a continuación:

 $ cat <<EOF > my-resources.yaml apiVersion: v1 kind: ServiceAccount metadata: name: my-service-account namespace: default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: my-cluster-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-clusterrole subjects: - kind: ServiceAccount name: my-service-account namespace: default EOF $ cat <<EOF > kustomization.yaml namespace: foo-namespace namePrefix: foo-prefix- resources: - my-resources.yaml EOF $ kustomize build apiVersion: v1 kind: ServiceAccount metadata: name: foo-prefix-my-service-account namespace: foo-namespace --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: foo-prefix-my-cluster-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-clusterrole subjects: - kind: ServiceAccount name: foo-prefix-my-service-account namespace: foo-namespace