2V0-71.23 Question 160
Select 2You are managing a Tanzu Kubernetes Grid (TKG) cluster and need to ensure that developers can deploy workloads without having administrative access to the cluster. Which access policies and roles should you configure to achieve this goal?
- A
Assign the 'edit' role to the developers in the specific namespace where they need to deploy workloads.
- B
Grant the developers 'cluster-admin' privileges to give them full access to the cluster.
- C
Create a RoleBinding in the target namespace and bind it to the 'view' role for the developers.
- D
Set up a RoleBinding in the target namespace and bind it to the 'edit' role for the developers.
- E
Assign the 'view' role at the cluster scope to the developers.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure developers can deploy workloads without administrative access, you should grant them the 'edit' role in the specific namespace where they need to work. This role allows them to manage resources within the namespace while adhering to the principle of least privilege. Granting 'cluster-admin' privileges or assigning the 'view' role would either provide excessive permissions or insufficient permissions for their task.
- A. Correct.
This is correct because the 'edit' role allows for the creation, modification, and deletion of resources in a specific namespace without granting cluster-wide administrative access.
- B. Incorrect.
This is incorrect because granting 'cluster-admin' privileges provides unrestricted access to the entire cluster, which violates the principle of least privilege.
- C. Incorrect.
This is incorrect because the 'view' role only allows read-only access to resources and does not permit developers to deploy workloads.
- D. Correct.
This is correct because creating a RoleBinding with the 'edit' role in a specific namespace ensures that developers can manage resources only within that namespace.
- E. Incorrect.
This is incorrect because the 'view' role at the cluster scope only allows read-only access to all namespaces and does not permit deploying workloads.