Question

You created a ClusterRole named 'pod-reader' that grants get, list, and watch on pods. A developer's ServiceAccount 'ci-bot' in the 'dev' namespace needs to read pods only within the 'dev' namespace. Which binding correctly grants exactly this access using the existing ClusterRole?

Accepted Answer

Create a RoleBinding in the 'dev' namespace that references the ClusterRole 'pod-reader' and the ServiceAccount 'ci-bot'.

Answer

Create a ClusterRoleBinding that references the ClusterRole 'pod-reader' and the ServiceAccount 'ci-bot' in namespace 'dev'.

Answer

Create a RoleBinding in the 'default' namespace that references the ClusterRole 'pod-reader' and the ServiceAccount 'ci-bot'.

Answer

Convert the ClusterRole to a Role in the 'dev' namespace, then create a ClusterRoleBinding referencing it.