Is there any way to via Rancher let a user

foo

get pods in namespace

bar

across all clusters? Or does such a rule need to be added via Role and RoleBindings manually in each cluster?