Missing Rolebindings from lookup

[sudermanjr]

I gave a service account circleci in the namespace helm-system the rolebinding to give it cluster-admin in the development namespace, and rbac-lookup doesn't seem to detect this.

└─ k get rolebinding rbac-definition-circleci-cluster-admin -oyaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: "2019-12-03T18:19:04Z"
  labels:
    rbac-manager: reactiveops
  name: rbac-definition-circleci-cluster-admin
  namespace: development
  ownerReferences:
  - apiVersion: rbacmanager.reactiveops.io/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: RBACDefinition
    name: rbac-definition
    uid: 4919eaca-d8ef-4382-8cbb-2cdbe56f9a47
  resourceVersion: "89419"
  selfLink: /apis/rbac.authorization.k8s.io/v1/namespaces/development/rolebindings/rbac-definition-circleci-cluster-admin
  uid: ce79f178-d006-4756-96cb-638ebdc1f9d3
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: circleci
  namespace: helm-system
 ~/azure-networking  ⎈  sudermanjr-test development 

└─ rbac-lookup circleci -owide
SUBJECT                                SCOPE          ROLE                   SOURCE
ServiceAccount/helm-system:circleci    cluster-wide   ClusterRole/circleci   ClusterRoleBinding/rbac-definition-circleci-circleci

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[sudermanjr]

Okay, I think I might have tracked this down. Steps to reproduce:

1. Create service account circleci in namespace one
2. Create this rolebinding in two namespace, both two and three

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: circleci-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: circleci
  namespace: one

Results:

▶ rbac-lookup circle -owide
SUBJECT                        SCOPE   ROLE                        SOURCE
ServiceAccount/one:circleci    two     ClusterRole/cluster-admin   RoleBinding/circleci-cluster-admin

▶ k delete ns two
namespace "two" deleted

▶ rbac-lookup circleci -owide
SUBJECT                        SCOPE   ROLE                        SOURCE
ServiceAccount/one:circleci    three   ClusterRole/cluster-admin   RoleBinding/circleci-cluster-admin