CKS-Lessons/learning-records/0003-rbac-retrieval-and-boundary-verification.md

RBAC retrieval and boundary verification

The learner wrote the NetworkPolicy and namespace-scoped RBAC solution from memory, without consulting documentation. In the live lab, the report-reader ServiceAccount can get and list ConfigMaps but cannot create ConfigMaps or read Secrets, demonstrating correct least-privilege scope and verification discipline.

Evidence

Live kubectl auth can-i results: yes, yes, no, no for the required four permissions.