2V0-71.23 Question 161
Select 2A company is using VMware Tanzu Mission Control (TMC) to manage multiple Kubernetes clusters across different environments. As part of its security policy, the company wants to enforce role-based access control (RBAC) for cluster management. The administrator needs to create an access policy that allows a group of developers to deploy workloads on specific clusters without giving them permissions to modify cluster configurations. Which combination of roles and policies should the administrator assign?
- A
Assign the 'cluster.admin' role at the organization level.
- B
Assign the 'namespace.edit' role at the namespace level.
- C
Assign the 'workspace.developer' role at the workspace level.
- D
Assign the 'cluster.view' role at the cluster level.
- E
Assign the 'namespace.view' role at the namespace level.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirement of allowing developers to deploy workloads without modifying cluster configurations, the administrator should assign the 'namespace.edit' role at the namespace level to enable workload deployment. Additionally, the 'workspace.developer' role can be assigned at the workspace level to manage workloads while maintaining separation of concerns. Other roles, such as 'cluster.admin' or 'cluster.view,' are either too permissive or insufficient for this use case.
- A. Incorrect.
The 'cluster.admin' role provides full administrative privileges at the organization level, which exceeds the required permissions and violates the principle of least privilege.
- B. Correct.
The 'namespace.edit' role allows developers to deploy and manage workloads within specific namespaces, which aligns with the requirement to enable workload deployment without modifying cluster configurations.
- C. Correct.
The 'workspace.developer' role grants permissions to manage workloads within a workspace, which is suitable for developers who need access to specific clusters or namespaces.
- D. Incorrect.
The 'cluster.view' role is a read-only role for viewing cluster details but does not allow workload deployment, which does not fulfill the requirement.
- E. Incorrect.
The 'namespace.view' role allows read-only access to namespaces but does not permit workload deployment, making it insufficient for the given scenario.