Question

A developer's CI pipeline uses a ServiceAccount named 'deployer' in the 'staging' namespace. The pipeline must be able to create, update, and list Deployments only within the 'staging' namespace, but it currently receives 'Error from server (Forbidden): deployments.apps is forbidden'. You want to grant exactly the required permissions following least-privilege. Which combination correctly grants this access?

Accepted Answer

Create a Role in the 'staging' namespace with rules for apiGroups ['apps'], resources ['deployments'], verbs ['create','update','list'], and a RoleBinding in 'staging' binding it to the 'deployer' ServiceAccount.

Answer

Create a ClusterRole with rules for deployments and a ClusterRoleBinding to the 'deployer' ServiceAccount.

Answer

Create a Role in the 'staging' namespace and a ClusterRoleBinding referencing that Role bound to the 'deployer' ServiceAccount.

Answer

Create a RoleBinding in the 'staging' namespace binding the built-in 'edit' ClusterRole to the 'deployer' user account.