FYI - this was not a Pulumi issue. I was using ClusterRole but RoleBinding when I should’ve been using ClusterRoleBinding to create a resource across namespaces.