concept cluster - admin ClusterRole in category kubernetes
This is an excerpt from Manning's book Kubernetes in Action.
Obviously, giving all your ServiceAccounts the cluster-admin ClusterRole is a bad idea. As is always the case with security, it’s best to give everyone only the permissions they need to do their job and not a single permission more (principle of least privilege).
Complete control of the Kubernetes cluster can be given by assigning the cluster-admin ClusterRole to a subject. As you’ve seen before, the admin ClusterRole doesn’t allow users to modify the namespace’s ResourceQuota objects or the Namespace resource itself. If you want to allow a user to do that, you need to create a Role-Binding that references the cluster-admin ClusterRole. This gives the user included in the RoleBinding complete control over all aspects of the namespace in which the Role-Binding is created.
If you’ve paid attention, you probably already know how to give users complete control of all the namespaces in the cluster. Yes, by referencing the cluster-admin ClusterRole in a ClusterRoleBinding instead of a RoleBinding.