2V0-71.23 Question 18
Select 3An organization is using VMware Tanzu Kubernetes Grid (TKG) to manage its Kubernetes environment. The platform team is tasked with configuring role-based access control (RBAC) for developers and administrators. Which of the following are critical concepts they need to understand when implementing RBAC in Kubernetes?
- A
Roles and RoleBindings define permissions within a specific namespace.
- B
ClusterRoles and ClusterRoleBindings provide permissions cluster-wide or across namespaces.
- C
RBAC rules are applied to Kubernetes ServiceAccounts, not directly to users.
- D
RBAC is automatically configured for all users when Kubernetes is deployed.
- E
RBAC policies can only be defined using YAML manifests and not through the Kubernetes API.
Show answer and explanation
Correct answers: A, B, C
Explanation
RBAC in Kubernetes is a key administrative concept allowing fine-grained control over user and service permissions. Understanding the difference between Roles/RoleBindings (namespace-scoped) and ClusterRoles/ClusterRoleBindings (cluster-wide) is crucial for correctly implementing RBAC. Additionally, while RBAC is commonly applied to ServiceAccounts, it can also manage user access via external systems. Administrators must explicitly configure RBAC rules to enforce security policies.
- A. Correct.
Correct: Roles and RoleBindings are namespace-scoped objects that define and assign permissions for resources within a specific namespace.
- B. Correct.
Correct: ClusterRoles and ClusterRoleBindings enable permissions that apply across the entire cluster or multiple namespaces, making them critical for cluster-wide administration and shared resources.
- C. Correct.
Correct: RBAC rules are often applied to Kubernetes ServiceAccounts because these accounts represent processes or applications interacting with the cluster. Users can also be managed via external identity systems, but ServiceAccounts are central to Kubernetes-native authentication.
- D. Incorrect.
Incorrect: RBAC is not automatically configured for all users. It must be explicitly defined by administrators to grant necessary permissions.
- E. Incorrect.
Incorrect: RBAC policies can be defined using YAML manifests or by directly interacting with the Kubernetes API using tools like kubectl. Both methods are valid.