Question

A platform engineer creates a ClusterRole named 'log-reader' that allows getting and listing pods in all namespaces. They then create a RoleBinding in the 'team-a' namespace that references the 'log-reader' ClusterRole and binds it to the user 'dev-alice'. After this, dev-alice reports she can read pods in 'team-a' but gets 'Forbidden' errors when reading pods in the 'team-b' namespace. What best explains this behavior?

Accepted Answer

A RoleBinding grants the permissions in the referenced ClusterRole only within the namespace where the RoleBinding exists, so access is limited to 'team-a'.

Answer

ClusterRoles cannot be referenced by RoleBindings, so the binding is silently ignored and dev-alice has no permissions at all.

Answer

The ClusterRole must include an explicit namespace field listing 'team-b' before its rules apply there.

Answer

RoleBindings automatically propagate to all namespaces, so the Forbidden error indicates a misconfigured API server.