Study. uk . com
  1. Home
  2. All questions
  3. Question 596

CKA study material · question 596 of 1000

A namespace administrator who cannot list Secrets cluster-wide tries to create a ClusterRole granting that permission. What happens?

  1. The request is forbidden unless they hold the escalate verb on clusterroles
  2. The ClusterRole is created but silently stripped of the secrets rule
  3. The request succeeds; RBAC only checks permissions at binding time
  4. The request succeeds but the role cannot be bound to anyone
Show the answer

Answer: A. The request is forbidden unless they hold the escalate verb on clusterroles

A subject may only create or update a role granting permissions they already hold at the same scope, unless they have been explicitly granted the escalate verb.

Source: Using RBAC Authorization (Kubernetes) — Privilege escalation prevention and bootstrapping › Restrictions on role creation or update

Challenge yourself on this topic → Study as cards