A city permits API only needs to read ConfigMaps and update its own Deployment inside the permits namespace. A teammate drafts a ClusterRoleBinding to a ClusterRole with those verbs. What change best applies least privilege?
Select an answer to reveal the explanation.
Short Explanation
Think building keys versus master keys. This app only works in one hallway, so a namespace Role is the right key — not a cluster-wide badge. ClusterRoleBindings hand out building-wide power the permits team does not need.
Full Explanation
Roles grant permissions inside a single namespace; ClusterRoles define permission rules that can be bound cluster-wide or reused. Binding a ClusterRole with a ClusterRoleBinding authorizes those verbs across the cluster for the subject. For an application that only operates in one namespace, a Role plus RoleBinding (or a RoleBinding to a ClusterRole used as a namespaced permission set) keeps authorization aligned with least privilege.