A RoleBinding grants a role's rules to subjects (users, groups, ServiceAccounts) in its own namespace; a ClusterRoleBinding grants them everywhere. A RoleBinding may point at a ClusterRole, which grants that template in one namespace only, the usual way to hand out view or edit. Kubernetes 5,150 has no user objects: a user is whatever name a client certificate or OIDC token carries, so a binding can name one before it exists. Impersonation (--as) lets an administrator check the result:
kubectl create rolebinding alice-view --clusterrole=view --user=alice
kubectl auth can-i list pods --as=alice
kubectl auth can-i list pods --as=alice -n kube-system
kubectl auth can-i get secrets --as=alice
kubectl auth can-i delete pods --as=alice
kubectl auth whoami | grep -e Username -e Groups | tr -s ' 'rolebinding.rbac.authorization.k8s.io/alice-view created yes no no no Username kubernetes-admin Groups [kubeadm:cluster-admins system:authenticated]
Alice reads Pods in booknest and nowhere else, cannot read Secrets and cannot delete. You, in contrast, are kubernetes-admin in the kubeadm 5,150 :cluster-admins group, which a ClusterRoleBinding ties to cluster-admin; keep that credential for administration only. A binding's roleRef is immutable: to point it at another role, delete and recreate it.