On-call staff need a ServiceAccount that can inspect Pods and Deployments in the billing namespace for troubleshooting but must not delete or mutate them. Which Role verb set best matches least privilege?
Select an answer to reveal the explanation.
Short Explanation
Read-only support is like a library card: look and list, do not rewrite the books. get, list, and watch cover inspection. delete and patch are write powers on-call does not need for pure troubleshooting.
Full Explanation
On-call staff who need a ServiceAccount that can inspect Pods and Deployments in the billing namespace for troubleshooting—but must not delete or mutate them—should receive the verb set get, list, and watch on pods and deployments. Those read verbs match least privilege for municipal billing incident response: responders can observe objects and stream changes without gaining destructive power in a financially sensitive namespace.
Granting create, update, patch, and delete on pods and deployments fails least privilege for a read-only on-call mission and invites accidental outages during stressful incidents. Impersonate and bind on serviceaccounts and roles are RBAC-administration capabilities, not simple inspect rights for viewing workloads. escalate and wildcard star on all resources in the namespace vastly exceed troubleshooting needs and violate least-privilege norms for civic operations teams.
Exam caveat: practical kubectl get usage typically requires list in addition to get, and watch supports tools that stream updates—omit list and everyday inventory commands fail unexpectedly. Operational check: create a Role with get/list/watch on pods and deployments, bind the on-call ServiceAccount in billing, verify that delete and patch are Forbidden, and confirm get and describe succeed during an on-call drill.