Use k8s rbac for authorization

K8S rbac is solid implementation of rbac. Use it welll can avoid reinvent the wheel for an application.

Use a namespace per user to scope user resources

Use user to represent an actual user. Then use role and role binding to control permissions.