Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

RedHat EX380 Exam - Topic 1 Question 1 Discussion

Actual exam question for RedHat's EX380 exam

Question #: 1
Topic #: 1

[All EX380 Questions]

SIMULATION

Task SIMULATION 7

Service Accounts and RBAC -- Grant Cluster Reader Role

ASee thesolution below in Explanation

Show Suggested Answer

Suggested Answer: A

Step 1: Confirm the service account exists in auth-audit.

It must exist before a role can be assigned to it.

Step 2: Run the command:

oc adm policy add-cluster-role-to-user cluster-reader system:serviceaccount:auth-audit:audit

Step 3: Verify the binding is added.

The lab output shows:

clusterrole.rbac.authorization.k8s.io/cluster-reader added: 'system:serviceaccount:auth-audit:audit'

Detailed explanation:

This binds the cluster-reader cluster role to the audit service account. The full subject format system:serviceaccount:namespace:name is required because OpenShift RBAC needs the exact service account identity. The cluster-reader role is broader than a project-scoped view role because it allows read-level access across cluster resources. This is appropriate for auditing or inspection use cases where the account must observe but not modify. The distinction between cluster roles and namespaced roles is important: cluster roles apply to non-namespaced resources and broad cluster visibility, while local roles are limited to individual projects. This Task is a classic RBAC operation that combines identity creation with controlled privilege assignment.

============

by Iraida at May 07, 2026, 08:47 PM

Limited Time Offer

25%

Off

Get Premium EX380 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noel

3 days ago

I might struggle with the details.

upvoted 0 times

...

Cornell

8 days ago

Same here, it makes sense.

upvoted 0 times

...

Annamaria

13 days ago

I would choose option A.

upvoted 0 times

...

Katina

18 days ago

Right, only read access is needed.

upvoted 0 times

...

Hyman

23 days ago

I think it's about limiting access.

upvoted 0 times

...

Noel

29 days ago

I feel unsure about the permissions.

upvoted 0 times

...

Cornell

1 month ago

Cluster Reader role seems straightforward.

upvoted 0 times

...

Annamaria

1 month ago

I agree, RBAC can be confusing.

upvoted 0 times

...

Katina

1 month ago

This question is tricky.

upvoted 0 times

...

Sonia

2 months ago

I thought it was more restrictive than that!

upvoted 0 times

...

Kiley

2 months ago

Yup, it's a standard practice in RBAC.

upvoted 0 times

...

Kenneth

2 months ago

Wait, can service accounts really have that role?

upvoted 0 times

...

Elli

2 months ago

Totally agree, it's essential for security!

upvoted 0 times

...

Anastacia

2 months ago

Cluster Reader role allows read-only access.

upvoted 0 times

...

Herminia

3 months ago

I remember that we need to use `kubectl` to grant roles, but I’m not confident about the syntax for this specific task.

upvoted 0 times

...

Mollie

4 months ago

I feel a bit confused about the difference between Cluster Reader and other roles. Did we cover that in our study sessions?

upvoted 0 times

...

Mary

4 months ago

This seems similar to a practice question we did on RBAC, but I can't recall the exact commands we used.

upvoted 0 times

...

Christene

4 months ago

I think I remember something about assigning roles to service accounts, but I'm not entirely sure how to do it for the Cluster Reader role.

upvoted 0 times

...