kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1

metadata:
  name: clusterrolebinding_name
  #namespace: desired_namespace

roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: desired-clusterrole

subjects:
# Direct user
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: desired_username

# Direct group
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: desired_groupname

# Authenticated user with RBAC
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated

# Not authenticated with RBAC
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:unauthenticated

# Single ServiceAccount in a namespace
- apiGroup: rbac.authorization.k8s.io
  kind: ServiceAccount
  name: desired_serviceaccount
  namespace: desired_namespace

# All ServiceAccount's in a namespace
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:namespace

# All ServiceAccount's
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts
