An app ServiceAccount should update only the ConfigMap named billing-ui-config, not every ConfigMap in the namespace. How should the Role be constrained?
Select an answer to reveal the explanation.
![To Create an exciting colorful infographic that explains the concepts in the question: Question: An app ServiceAccount should update only the ConfigMap named billing-ui-config, not every ConfigMap in the namespace. How should the Role be constrained? Correct Answer: Add resourceNames: ["billing-ui-config"] on the ConfigMap rule with update and get verbs Put EVERY visible label in double quotes. No people. No A/B/C/D letters. In one of the four corners put a little "Navy Duck".](/media/cncf/ckad/CKAD-e1-q182-infographic.webp)
Short Explanation
resourceNames is the sticky note that says “only this locker,” not the whole row of lockers. Put billing-ui-config on the ConfigMap rule. Subject fields name who is allowed, not which object they may touch.
Full Explanation
Role rules can include resourceNames to limit verbs to specifically named resources of that type. For ConfigMaps, listing billing-ui-config restricts updates to that object. RoleBinding subjects identify who receives the Role; they do not scope resource names. nonResourceURLs apply to API paths outside namespaced resources and are the wrong tool here.