A municipal CI bot must create Secrets only in billing, but someone bound a ClusterRole with a ClusterRoleBinding by mistake. What should ops change first to restore least privilege?
Select an answer to reveal the explanation.
Short Explanation
The bot got a master key when it only needed the billing vault combination. Swap the ClusterRoleBinding for a RoleBinding in billing so create-secret stops spanning the whole cluster. Same verbs, tighter door.
Full Explanation
A ClusterRoleBinding applies the referenced role’s permissions cluster-wide. For a CI ServiceAccount that should create Secrets only in billing, authorization must use a RoleBinding in that namespace—either to a Role defined there or to a ClusterRole used in a namespaced binding. Removing the mistaken ClusterRoleBinding and adding the namespace-scoped binding restores least privilege without disabling the bot’s identity entirely. NetworkPolicies and Ingress annotations do not authorize Secret creation on the API.