A Role grants get/list on ConfigMaps in maps. How is ServiceAccount map-reader authorized to use that Role?
Select an answer to reveal the explanation.
Short Explanation
Roles list verbs; RoleBindings name who gets them. Put kind: ServiceAccount, name map-reader, and its namespace in the binding subjects. That's how the SA actually receives the ConfigMap read rights.
Full Explanation
RBAC separates permission sets (Role/ClusterRole) from identity bindings (RoleBinding/ClusterRoleBinding). To authorize a ServiceAccount, add a subject with kind: ServiceAccount, name, and namespace on a RoleBinding that references the Role. Embedding SA names in rules, ownerReferences, or aggregate labels alone does not grant the Role's verbs.