To grant a user read access to resources in a project using RBAC, which approach is correct?

To grant a user read access to resources in a project using RBAC, which approach is correct?

• A. Create a Role with read verbs
• B. Create a ClusterRole with read verbs
• C. Create a Role with read verbs and bind it to the user with a RoleBinding in the project
• D. Create a Role with read verbs and bind it to the user with a ClusterRoleBinding

Answer: (C)

RBAC grants access by binding subjects to roles. A Role is scoped to a single namespace (the project), while a ClusterRole is cluster-wide. To give a user read access inside a specific project, define a Role in that project's namespace that allows read operations (for example, get, list, watch) on the resources you want, and then bind that Role to the user with a RoleBinding in the same project. This confines the permission to that namespace. A ClusterRole would grant access across the whole cluster, not just the project, and simply creating a Role alone doesn’t grant any access without a binding. Using a ClusterRoleBinding with a Role isn’t the standard pattern for namespace-scoped permissions. Therefore, the correct approach is to create the Role and bind it with a RoleBinding in the project.

RBAC grants access by binding subjects to roles. A Role is scoped to a single namespace (the project), while a ClusterRole is cluster-wide. To give a user read access inside a specific project, define a Role in that project's namespace that allows read operations (for example, get, list, watch) on the resources you want, and then bind that Role to the user with a RoleBinding in the same project. This confines the permission to that namespace. A ClusterRole would grant access across the whole cluster, not just the project, and simply creating a Role alone doesn’t grant any access without a binding. Using a ClusterRoleBinding with a Role isn’t the standard pattern for namespace-scoped permissions. Therefore, the correct approach is to create the Role and bind it with a RoleBinding in the project.