A CI Job deploys apps using a dedicated ServiceAccount in the payments namespace but cannot create Deployments. What binding pattern grants the least-privilege fix?
Select an answer to reveal the explanation.
Short Explanation
Give the CI ServiceAccount a namespace Role and RoleBinding—like a contractor badge for one department. That is least privilege for deploy rights. cluster-admin everywhere is a master key you do not need.
Full Explanation
Workload identity for CI should use a ServiceAccount bound via RoleBinding to a Role that lists only the verbs and resources required (for example create/update Deployments) in the target namespace. Cluster-admin for default accounts, ConfigMap-held user tokens, and kubelet mutation grants are overly broad or incorrect mechanisms for authorizing a deploy Job’s ServiceAccount.