# CKS-016 — Replace cluster-admin with namespaced RBAC

Domain: **2.1 Least-privilege RBAC**  
Time: **5 minutes** · Score: **Section B only**

## Existing dangerous binding

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: maya-admin
subjects:
- kind: User
  name: maya
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
```

## Task

Remove this binding. In namespace `blue`, allow user `maya` only to:

- `get`, `list`, and `watch` Pods;
- `get` Pod logs.

Create namespaced Role `maya-observer` and RoleBinding `maya-observer`. Include commands that verify one allowed action and that reading Secrets is denied.

## Section B — scored answer

```bash
# Commands
```

```yaml
# Complete Role and RoleBinding
```

Say **Grade CKS-016** when saved.