2V0-71.23 Question 164
Select 2You are a Kubernetes administrator managing a Tanzu Kubernetes Grid (TKG) cluster for your organization. You need to configure access policies and roles to ensure that developers can deploy workloads only in a specific namespace without granting them cluster-wide privileges. Which combination of actions would achieve this requirement?
- A
Create a Kubernetes Role with permissions to manage resources within the specific namespace.
- B
Assign the 'cluster-admin' ClusterRole to the developers.
- C
Create a Kubernetes RoleBinding that binds the Role to the developers in the specific namespace.
- D
Assign the 'edit' ClusterRole to the developers at the cluster level.
- E
Bind a ClusterRole using a ClusterRoleBinding scoped to the specific namespace.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure developers can deploy workloads only in a specific namespace, you must use a namespace-scoped Kubernetes Role to define the permissions required and then bind this Role to the developers using a RoleBinding within that namespace. Using cluster-wide roles like 'cluster-admin' or 'edit' would grant broader permissions than necessary, violating the principle of least privilege.
- A. Correct.
Correct. A Kubernetes Role is namespace-scoped and can be used to define the specific permissions required for managing resources within the designated namespace.
- B. Incorrect.
Incorrect. The 'cluster-admin' ClusterRole grants full administrative access to the entire cluster, which exceeds the requirement and violates the principle of least privilege.
- C. Correct.
Correct. A RoleBinding is used to associate a Role with specific users or groups in a specific namespace, providing developers with the required permissions at the namespace level.
- D. Incorrect.
Incorrect. The 'edit' ClusterRole, when assigned at the cluster level, provides permissions across all namespaces rather than restricting them to a single namespace, which is not desired in this scenario.
- E. Incorrect.
Incorrect. A ClusterRoleBinding is used for cluster-scoped permissions or to bind ClusterRoles across multiple namespaces. It cannot restrict permissions to a specific namespace.