A new hire’s kubeconfig user can get Nodes but cannot create NetworkPolicies. What is the most likely RBAC gap?
Select an answer to reveal the explanation.
Short Explanation
Having eyes on the map of Nodes does not unlock drafting street rules. Create on NetworkPolicies needs an explicit rule for that resource and the networking.k8s.io apiGroup. Missing verb or wrong apiGroup is the usual gap—not a CoreDNS context typo.
Full Explanation
RBAC matches apiGroups, resources, and verbs independently. Permission to get nodes does not imply create on networkpolicies; those are different resources, and NetworkPolicy lives in networking.k8s.io. Fix the Role or ClusterRole (and binding) to include the create verb for networkpolicies. Users and ServiceAccounts can both be subjects; kubeconfig context quirks for CoreDNS are unrelated.