intermediateSecurity: RBAC, Service Accounts & Pod Security Standards
Why is RBAC described as purely additive with no explicit deny?
A subject's effective permissions are the union of every Role/ClusterRole bound to it. There is no deny rule type. Anything not explicitly granted is denied by omission.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response