CKS Security Quest · Cluster Hardening
Replace cluster-admin
Give one user exact observation rights in one namespace.
Task
Delete ClusterRoleBinding maya-admin. In blue, create Role maya-observer and matching RoleBinding so user maya can get/list/watch Pods and get Pod logs—nothing more.
Verify one allowed operation and denied Secret access.