City auditors need read-only access to Deployments across every namespace for inventory. Which RBAC design fits?
Select an answer to reveal the explanation.
Short Explanation
Cross-namespace inventory is a building-wide badge, not a single-floor pass. Auditors need a ClusterRole for deployments plus a ClusterRoleBinding so those verbs work in every namespace. A Role stuck in default would miss the rest of the city estate.
Full Explanation
Read access to Deployments in all namespaces requires cluster-scoped authorization. A ClusterRole defining get, list, and watch on deployments, bound with a ClusterRoleBinding to the auditors’ group (or users), grants that inventory view everywhere. A namespace Role only applies where it exists. Kubelet credentials and ConfigMap copies are not substitutes for API RBAC on the deployments resource.