title: RBAC Issue with user in non-default namespace
body: <p>I just created a cluster with kubeadm last week, version 1.7.3 on CentOS7. I followed the steps at <a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/#use-case-1-create-user-with-limited-namespace-access" rel="nofollow noreferrer">Bitnami</a> to create certs and a config for a user in a new namespace and a new context for RBAC. The user can authenticate to the cluster fine with the config and his kubectl commands stay in the namespace. He tries to run a deployment and gets an Error forbidden from the server. His service creates but not the deployment, so I'm confused as to partial ability to create things.</p>
  
  <p>Role:</p>
  
  <pre><code>kind: Role
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    namespace: dev
    name: deployment-manager
  rules:
    - apiGroups: ["*"]
      resources: ["*"]
      verbs: ["*"]
  </code></pre>
  
  <p>Rolebinding:</p>
  
  <pre><code>kind: RoleBinding
  apiVersion: rbac.authorization.k8s.io/v1beta1
  metadata:
    name: deployment-manager-binding
    namespace: dev
  subjects:
  - kind: User
    name: $ID
    apiGroup: ""
  roleRef:
    kind: Role
    name: deployment-manager
    apiVersion: rbac.authorization.k8s.io/v1beta1
  
  
  # kubectl get namespaces
  NAME                 STATUS    AGE
  default              Active    6d
  kube-public          Active    6d
  kube-system          Active    6d
  dev                  Active    1d
  
  
  kubectl config get-contexts
  CURRENT   NAME                          CLUSTER      AUTHINFO       NAMESPACE
  *         kubernetes-admin@kubernetes   kubernetes   kubernetes-admin
            dev                           kubernetes     $ID          dev
  </code></pre>
  
  <p>kubeconfig of user</p>
  
  <pre><code>$ kubectl config view
    apiVersion: v1
    clusters:
    - cluster:
        certificate-authority-data: REDACTED
        server: https://$IP:6443
      name: kubernetes
    contexts:
    - context:
        cluster: kubernetes
        namespace: dev
        user: $ID 
      name: dev 
    current-context: dev
    kind: Config
    preferences: {}
    users:
    - name: $ID
      user:
        client-certificate-data: REDACTED
        client-key-data: REDACTED
  </code></pre>
  
  <p>user attempt</p>
  
  <pre><code>[$ID]$ kubectl create -f k8s.yml --record
  service "aggregator-service" created
  Error from server (Forbidden): error when creating "k8s.yml": User "$ID" cannot create deployments.apps in the namespace "dev". (post deployments.apps)
  
  [$ID ~]$ kubectl get svc
  NAME                 CLUSTER-IP      EXTERNAL-IP   PORT(S)                         AGE
  aggregator-service   10.xxx.xxx.xxx   &lt;pending&gt;     8090:32524/TCP,8091:30329/TCP   24
  </code></pre>
  
  <p>k8s.yml</p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    name: aggregator-service
    labels:
      app: aggregator
      tier: agg
  spec:
    type: LoadBalancer
    ports:
    - port: 8090
      targetPort: 8090
      name: http
    - port: 8091
      targetPort: 8091
      name: http-admin
    selector:
      app: aggregator
      tier: agg
  ---
  apiVersion: apps/v1beta1
  kind: Deployment
  metadata:
    name: aggregator-deployment
  spec:
    replicas: 1
    template:
      metadata:
        labels:
          app:  aggregator
          tier: agg
      spec:
        containers:
        - name: aggregator-service
          image: $IMAGE
          ports:
          - containerPort: 8090
  </code></pre>
  
  <p>Any pointers in the right direction would be appreciated!
  Thanks.</p>