Which RBAC component binds a user or group to a ClusterRole for cluster-wide permissions?

Which RBAC component binds a user or group to a ClusterRole for cluster-wide permissions?

• A. RoleBinding binds a user to a Role within a namespace
• B. A Namespace is required to bind a user to a ClusterRole
• C. A ServiceAccount binds a user to a Role in a namespace
• D. A ClusterRoleBinding binds a user or group to a ClusterRole for cluster-wide permissions

Answer: (D)

Cluster-wide access in Kubernetes RBAC is granted by binding subjects to a ClusterRole using a ClusterRoleBinding. This binding connects users, groups, or service accounts to a ClusterRole, so the resulting permissions apply across the entire cluster. In contrast, binding a subject to a Role within a specific namespace (RoleBinding) limits those permissions to that namespace. A Namespace is just a scope, not a binding mechanism, and while a ServiceAccount can be a subject, binding it to a Role in a namespace yields namespace-scoped access. So the mechanism that provides cluster-wide permissions is ClusterRoleBinding.

Cluster-wide access in Kubernetes RBAC is granted by binding subjects to a ClusterRole using a ClusterRoleBinding. This binding connects users, groups, or service accounts to a ClusterRole, so the resulting permissions apply across the entire cluster. In contrast, binding a subject to a Role within a specific namespace (RoleBinding) limits those permissions to that namespace. A Namespace is just a scope, not a binding mechanism, and while a ServiceAccount can be a subject, binding it to a Role in a namespace yields namespace-scoped access. So the mechanism that provides cluster-wide permissions is ClusterRoleBinding.