I created a service account that contains the default cluster role "view" which makes it can access all of our resources with view permission.
But I would like to add a limitation so that this service account can't access one of our namespace.
Any idea how can I achieve this?
Br,
Tim
Kubernetes has only two permission scopes: Cluster(ClusterRole) or Namespace(Role) and no way to limit or exclude a ClusterRole to specific namespaces. If you want to restrict your ServiceAccount to specific namespaces you cannot use a ClusterRole but must use a Role in every namespace the ServiceAccount should have access in.
In addition to the other answer, when you use a Role, you need to specify the namespace on your RoleBinding. For example:
$ kubectl create rolebinding my-binding --role=myrole --user=myuser --namespace=mynamespace