How to create users/groups restricted to namespace in Kubernetes using RBAC API?
First, you need to allow access to the URLs kubectl uses for API discovery and validation (swagger, listings of API groups and resource types, etc).
The easiest way to do that is to load the default bootstrap cluster roles and cluster role bindings:
kubectl create -f https://raw.githubusercontent.com/kubernetes/kubernetes/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yamlkubectl create -f https://raw.githubusercontent.com/kubernetes/kubernetes/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-role-bindings.yamlThat will create a system:discovery ClusterRole and bind all users (authenticated and unauthenticated) to it, allowing them to access swagger and API group information.
Second, you shouldn't include the dev service account in the all cluster role binding. That would allow that service account (and anyone with access to secrets in the dev namespace containing the dev service account credentials) cluster wide access