CKA Practice Question 1: RBAC ClusterRole Binding Scope

Certified Kubernetes Administrator (CKA) · Test 1 · question 1 of 10

RBAC & Authorizationmedium

You create a ClusterRole named pod-reader granting get, list, and watch on pods, then bind it to the user dev-user with a RoleBinding in the dev namespace. dev-user reports they can list pods in dev but get a Forbidden error in every other namespace.

You need dev-user to read pods in all namespaces, including namespaces created in the future, with the least additional configuration and without granting any other permission. What should you do?

Show answer and explanation

Answer:

B. Replace the RoleBinding with a ClusterRoleBinding that references the same ClusterRole

A RoleBinding is a namespaced object. When a RoleBinding references a ClusterRole, it grants that ClusterRole's permissions only inside the RoleBinding's own namespace, which is exactly the behaviour observed. A ClusterRoleBinding grants the ClusterRole's rules across every namespace, including ones that do not exist yet, so option B is the minimal correct change.

Option A would technically work, but it is the opposite of minimal: it requires one Role and one RoleBinding per namespace and would need new objects every time a namespace is created; the stem rules this out.

Option C is not possible. namespace is part of a RoleBinding's identity as a namespaced resource; omitting it does not make the binding cluster-scoped, it just places the object in the default namespace (or whatever the current context is).

Option D grants the permissions, but cluster-admin allows every action on every resource. The stem requires granting no other permission, and this is a serious privilege escalation.

Reference: Using RBAC Authorization

Practice Test 1 ›

Study guides for CKA

Docker interview questions: commands, scenarios, experiencedDocker interview questions with answers: Dockerfiles and builds, run and debug commands, networking, volumes, Compose, security, and Docker vs Kubernetes.

Kubernetes interview questions: scenarios for experiencedScenario-based Kubernetes interview questions for experienced engineers: CrashLoopBackOff, DNS, RBAC, drains and etcd, with the commands and fixes.

Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.

CKA exam guide: price, voucher, booking and what it testsThe CKA exam explained: the $445 price, what the voucher includes, how to book it with PSI, the five domains and how to prepare for the hands-on tasks.

Best Kubernetes certification: CKA vs CKAD vs CKSWhich Kubernetes certification to take first - CKA, CKAD or CKS compared on format, cost, prerequisites and role, plus KCNA and KCSA for beginners.

Kubernetes NetworkPolicy, explained for CKA, CKAD and CKSHow NetworkPolicy isolation works, why policies only add allows, the namespaceSelector AND/OR trap, DNS egress, and what your CNI has to support.

Kubernetes Service types, Ingress and Gateway APIClusterIP, NodePort, LoadBalancer, ExternalName and headless Services, how selectors build endpoints, and how to debug a Service for CKA and CKAD.