cks-final/submissions/CKS-016-skipped-by-topic-advance.md

CKS-016 — Replace cluster-admin with namespaced RBAC

Domain: 2.1 Least-privilege RBAC
Time: 5 minutes · Score: Section B only

Existing dangerous binding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: maya-admin
subjects:
- kind: User
  name: maya
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin

Task

Remove this binding. In namespace blue, allow user maya only to:

• get, list, and watch Pods;
• get Pod logs.

Create namespaced Role maya-observer and RoleBinding maya-observer. Include commands that verify one allowed action and that reading Secrets is denied.

Section B — scored answer

# Commands

# Complete Role and RoleBinding

Say Grade CKS-016 when saved.