Bug 1439859

Cause: When the RestrictUsersAdmission admission control plug-in is enforcing role binding restrictions and examines a role binding with a service account subject, the plug-in requires that the subject have an explicit namespace that matches some role binding restriction in order to be admitted. When an application template contains a role binding with a service account subject, typically the subject's namespace is left blank in the template (rather than hardcoding a namespace or requiring a parameter) so that the namespace will be defaulted to the namespace in which the role binding is created. (An example is the jenkins-persistent application template and its jenkins_edit role binding.) However, this defaulting happens only after admission control is performed. Consequence: Role binding restrictions cannot match against role bindings as they are typically specified in an application template (that is, with the namespace left unspecified/blank), and so the RestrictUsersAdmission admission control plug-in rejects these role bindings. Fix: The RestrictUsersAdmission admission control plug-in has been changed to treat a blank namespace in a service account subject as implicitly matching the namespace of the role binding restriction. Result: The RestrictUsersAdmission admission control plug-in, with appropriate role binding restrictions, will now admit the aforementioned role bindings.