diff --git a/tcp_tests/managers/k8s/cluster.py b/tcp_tests/managers/k8s/cluster.py
index 8ffb4d1..db7bb18 100644
--- a/tcp_tests/managers/k8s/cluster.py
+++ b/tcp_tests/managers/k8s/cluster.py
@@ -42,6 +42,8 @@
 from tcp_tests.managers.k8s.services import K8sServiceManager
 from tcp_tests.managers.k8s.replicasets import K8sReplicaSetManager
 from tcp_tests.managers.k8s.networkpolicies import K8sNetworkPolicyManager
+from tcp_tests.managers.k8s.clusterrolebindings import \
+    K8sClusterRoleBindingManager
 
 
 class K8sCluster(object):
@@ -89,6 +91,7 @@
         self.api_extensions = client.ExtensionsV1beta1Api(api_client)
         self.api_autoscaling = client.AutoscalingV1Api(api_client)
         self.api_batch = client.BatchV1Api(api_client)
+        self.api_rbac_auth = client.RbacAuthorizationV1Api(api_client)
 
         self.nodes = K8sNodeManager(self)
         self.pods = K8sPodManager(self)
@@ -111,3 +114,4 @@
         self.pvolumes = K8sPersistentVolumeManager(self)
         self.replicasets = K8sReplicaSetManager(self)
         self.networkpolicies = K8sNetworkPolicyManager(self)
+        self.clusterrolebindings = K8sClusterRoleBindingManager(self)
diff --git a/tcp_tests/managers/k8s/clusterrolebindings.py b/tcp_tests/managers/k8s/clusterrolebindings.py
new file mode 100644
index 0000000..d958817
--- /dev/null
+++ b/tcp_tests/managers/k8s/clusterrolebindings.py
@@ -0,0 +1,54 @@
+#    Copyright 2017 Mirantis, Inc.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+
+
+from kubernetes import client
+
+from tcp_tests.managers.k8s.base import K8sBaseResource
+from tcp_tests.managers.k8s.base import K8sBaseManager
+
+
+class K8sClusterRoleBinding(K8sBaseResource):
+    resource_type = 'clusterrolebindings'
+
+    def _read(self, **kwargs):
+        return self._manager.api.read_cluster_role_binding(self.name, **kwargs)
+
+    def _create(self, body, **kwargs):
+        return self._manager.api.create_cluster_role_binding(body, **kwargs)
+
+    def _patch(self, body, **kwargs):
+        return self._manager.api.patch_cluster_role_binding(
+            self.name, body, **kwargs)
+
+    def _replace(self, body, **kwargs):
+        return self._manager.api.replace_cluster_role_binding(
+            self.name, body, **kwargs)
+
+    def _delete(self, **kwargs):
+        self._manager.api.delete_cluster_role_binding(
+            self.name, client.V1DeleteOptions(), **kwargs)
+
+
+class K8sClusterRoleBindingManager(K8sBaseManager):
+    resource_class = K8sClusterRoleBinding
+
+    @property
+    def api(self):
+        return self._cluster.api_rbac_auth
+
+    def _list(self, namespace, **kwargs):
+        return self.api.list_cluster_role_binding(**kwargs)
+
+    def _list_all(self, **kwargs):
+        return self._list(None, **kwargs)
diff --git a/tcp_tests/managers/k8s/serviceaccounts.py b/tcp_tests/managers/k8s/serviceaccounts.py
index 3b779eb..bc0db30 100644
--- a/tcp_tests/managers/k8s/serviceaccounts.py
+++ b/tcp_tests/managers/k8s/serviceaccounts.py
@@ -14,6 +14,8 @@
 
 from kubernetes import client
 
+from devops.helpers import helpers
+
 from tcp_tests.managers.k8s.base import K8sBaseResource
 from tcp_tests.managers.k8s.base import K8sBaseManager
 
@@ -41,6 +43,13 @@
         self._manager.api.delete_namespaced_service_account(
             self.name, self.namespace, client.V1DeleteOptions(), **kwargs)
 
+    def wait_secret_generation(self, timeout=90, interval=2):
+        def is_secret_generated():
+            secrets = self.read().secrets
+            return secrets is not None and len(secrets) > 0
+        helpers.wait(lambda: is_secret_generated(),
+                     timeout=timeout, interval=interval)
+
 
 class K8sServiceAccountManager(K8sBaseManager):
     resource_class = K8sServiceAccount