☁️ Free practice test question from: KCNA (KCNA)

In Kubernetes, access control involves two key components:

1. A policy definition (Role or ClusterRole) that specifies what actions can be performed

2. A binding (RoleBinding or ClusterRoleBinding) that connects those permissions to specific users

The main difference between these components lies in their scope:

Role vs. ClusterRole:

• A Role is namespace-specific and can only grant permissions within a single namespace

• A ClusterRole is cluster-wide and can grant permissions across all namespaces and to cluster-wide resources

RoleBinding vs. ClusterRoleBinding:

• A RoleBinding connects users to Roles (or ClusterRoles) within a specific namespace

• A ClusterRoleBinding connects users to ClusterRoles across the entire cluster

In summary: To restrict a user's access to resources within a specific namespace and prevent modification of cluster-wide resources, you need to define the permissions using a Role (scoped to the namespace) and then grant those permissions to the user using a RoleBinding (also within the same namespace).