Which construct restricts a developer to read-only access on pods within only the 'dev' namespace?
- A ClusterRole with ClusterRoleBinding
- B Role in 'dev' bound with a RoleBinding in 'dev' (correct answer)
- C Azure RBAC Reader on the cluster resource
- D NetworkPolicy
Shortcut: Namespace-scoped Role plus RoleBinding is the least-privilege construct. A ClusterRoleBinding would grant the permission across every namespace.