Thanks for the valuable document, I need to ask how instead of cluster role binding how can we use role and role-binding to avoid --group system:master and it should be namesapce based?

Thanks for a very useful stuff, I need to ask if instead of cluster role and binding can we user simple role and rolebinding to restrict on the namespaces bases access using IAM role?