Study. uk . com
  1. Home
  2. All questions
  3. Question 589

CKA study material · question 589 of 1000

An administrator writes a Role with resourceNames set, hoping to allow creating only a ConfigMap with a particular name. Why does this not work?

  1. resourceNames is ignored for namespaced resources
  2. The object's name is not known when a top-level create is authorized
  3. resourceNames may only be used with ClusterRoles
  4. create is not a verb RBAC recognises
Show the answer

Answer: B. The object's name is not known when a top-level create is authorized

A top-level create cannot be restricted by resourceNames because the new object's name is unknown at authorization time; the same limitation applies to deletecollection.

Source: Using RBAC Authorization (Kubernetes) — Referring to resources

Challenge yourself on this topic → Study as cards