2V0-71.23 Question 163
Select 2Your organization has deployed VMware Tanzu Kubernetes Grid (TKG) to manage multiple Kubernetes clusters across environments. As part of enforcing access policies, you are tasked with assigning roles that ensure developers can only deploy workloads to specific namespaces without granting them administrative privileges over the cluster. Which of the following roles and policies would you apply to achieve this requirement?
- A
Assign the 'edit' role to developers and restrict it to the specific namespaces where they will deploy workloads.
- B
Assign the 'cluster-admin' role to developers to give them full control of the cluster, ensuring they can perform their tasks without restrictions.
- C
Assign the 'view' role to developers to provide read-only access to the cluster and namespaces.
- D
Create a custom role with permissions to deploy workloads and bind it to developers for the specific namespaces.
- E
Use the 'system:masters' group to include developers, granting them full administrative access to all resources.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure developers can deploy workloads without granting excessive privileges, you should use roles like 'edit' or custom roles tailored to the required permissions. These roles can be scoped to specific namespaces, ensuring alignment with the principle of least privilege while fulfilling the deployment requirements. Assigning cluster-level administrative roles such as 'cluster-admin' or 'system:masters' would provide unnecessary access and pose a security risk, while read-only roles like 'view' would not meet the operational needs of the developers.
- A. Correct.
The 'edit' role allows users to create, modify, and delete resources within a namespace but does not grant administrative control over the cluster, making it suitable for developers.
- B. Incorrect.
The 'cluster-admin' role grants full control over the entire cluster, which exceeds the requirements and violates the principle of least privilege.
- C. Incorrect.
The 'view' role only allows read-only access and does not permit deployment of workloads, making it unsuitable for this scenario.
- D. Correct.
Creating a custom role with specific permissions for deployment and binding it to the developers' target namespaces ensures granular control and adheres to the principle of least privilege.
- E. Incorrect.
The 'system:masters' group is reserved for cluster administrators and provides unrestricted access, which is inappropriate for developers in this context.