A city permits API service must call the Kubernetes API to get and list Endpoints using its Pod's ServiceAccount. How should the team grant only those permissions?
Select an answer to reveal the explanation.
Short Explanation
Think of the ServiceAccount as the app's badge at the API desk—badges need explicit permissions, not a master key. Grant get/list on endpoints with a namespace Role and RoleBinding to that SA. Cluster-admin or NetworkPolicies are the wrong tools for API authorization.
Full Explanation
Pods that call the Kubernetes API authenticate as their ServiceAccount and still need RBAC for each verb and resource. For get/list on endpoints, define a Role in the app namespace with those rules and bind it to the dedicated ServiceAccount via RoleBinding. Cluster-admin over-grants; disabling the token or using NetworkPolicies does not authorize API access.