I am playing around with Minikube and I created a test user with certificates (mueller). He has set the CN of his certificate to mueller and the O to development.

Here is my role:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 namespace: development
 name: read-development-pods
rules:
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get", "list", "watch"]

and my rolebinding:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
 name: read-development-pods-rb
 namespace: development
subjects:
- kind: User
  name: mueller
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: read-development-pods
  apiGroup: rbac.authorization.k8s.io

Also I got my certificates set to the kubeconfig. The rules work fine.

Now my question is, can I get rid of my rolebinding, because having a rolebinding for each user is not very comfortable and I think I read somewhere that Kubernetes is able to use the O-field of the users certificate to automatically bind to the roles that are written in that field.