In RBAC, which resources are most appropriate to grant namespace-scoped permissions to create pods?

• A. ClusterRole and ClusterRoleBinding
• B. Role and RoleBinding
• C. SecurityContextConstraints alone
• D. ServiceAccount without bindings

Answer: (B)

The important idea here is using namespace-scoped RBAC to control who can perform actions in a specific namespace. A Role is defined within a single namespace and lists the allowed actions (verbs) on particular resources; a RoleBinding then ties that Role to a subject (user, group, or service account) within the same namespace. To allow creating pods in a given namespace, you define a Role with a rule for the pods resource and the create verb, and you bind that Role to the desired subject via a RoleBinding in that namespace.

Using a ClusterRole and ClusterRoleBinding would grant permissions cluster-wide, not limited to one namespace, which misses the namespace-scoped requirement. SecurityContextConstraints don’t grant create permissions, they govern pod security settings. A ServiceAccount without any bindings has no permissions to perform actions.