A county clerk portal needs a ServiceAccount that can list Pods only in the permits namespace, not cluster-wide. Which RBAC approach meets least privilege?
Select an answer to reveal the explanation.
Short Explanation
Least privilege here is like giving a desk key for one office, not the whole courthouse master key. A namespace Role plus RoleBinding limits list-pods to permits for that ServiceAccount. Cluster-wide bindings would overshoot what the clerk portal needs.
Full Explanation
Kubernetes RBAC scopes permissions with Roles (namespace) or ClusterRoles (cluster). For a ServiceAccount that must list Pods only in permits, define a Role in that namespace with the pods list verb and bind it with a RoleBinding to the ServiceAccount. A ClusterRoleBinding would authorize across namespaces, violating least privilege. NetworkPolicies do not replace API authorization, and binding cluster-admin—even via RoleBinding—still grants the cluster-admin ruleset when the referenced ClusterRole is that powerful.