Study. uk . com
  1. Home
  2. All questions
  3. Question 585

CKA study material · question 585 of 1000

A user has read access to Secrets in a namespace through a broad ClusterRole, and you want to take just that one permission away. What does RBAC allow?

  1. Adding a Role with a deny rule for secrets in that namespace
  2. Setting an except field on the existing ClusterRole's rule
  3. Adding a RoleBinding with a negative subject
  4. Nothing but narrowing or removing the grant itself
Show the answer

Answer: D. Nothing but narrowing or removing the grant itself

RBAC permissions are purely additive and there are no deny rules, so access is removed by changing or deleting the binding or role that granted it.

Source: Using RBAC Authorization (Kubernetes) — API objects › Role and ClusterRole

Challenge yourself on this topic → Study as cards