diff --git a/metropolis/node/kubernetes/reconciler/resources_rbac.go b/metropolis/node/kubernetes/reconciler/resources_rbac.go
index 15386a6..0976ba5 100644
--- a/metropolis/node/kubernetes/reconciler/resources_rbac.go
+++ b/metropolis/node/kubernetes/reconciler/resources_rbac.go
@@ -28,6 +28,7 @@
 	clusterRolePSPDefault                    = builtinRBACName("psp-default")
 	clusterRoleBindingDefaultPSP             = builtinRBACName("default-psp-for-sa")
 	clusterRoleBindingAPIServerKubeletClient = builtinRBACName("apiserver-kubelet-client")
+	clusterRoleBindingOwnerAdmin             = builtinRBACName("owner-admin")
 )
 
 type resourceClusterRoles struct {
@@ -150,5 +151,27 @@
 				},
 			},
 		},
+		clusterRoleBindingOwnerAdmin: &rbac.ClusterRoleBinding{
+			ObjectMeta: meta.ObjectMeta{
+				Name:   clusterRoleBindingOwnerAdmin,
+				Labels: builtinLabels(nil),
+				Annotations: map[string]string{
+					"kubernetes.io/description": "This binding grants the Metropolis Cluster owner access to the " +
+						"cluster-admin role on Kubernetes.",
+				},
+			},
+			RoleRef: rbac.RoleRef{
+				APIGroup: rbac.GroupName,
+				Kind:     "ClusterRole",
+				Name:     "cluster-admin",
+			},
+			Subjects: []rbac.Subject{
+				{
+					APIGroup: rbac.GroupName,
+					Kind:     "User",
+					Name:     "owner",
+				},
+			},
+		},
 	}
 }