Kubernetes Role-Based Access Control (RBAC) is implemented through theRBAC API group(rbac.authorization.k8s.io) and defines the core authorization primitives used to grant permissions to users, groups, and service accounts. The cluster-scoped objects declared by the RBAC API areClusterRoleandClusterRoleBinding. AClusterRoledefines a set of permissions (verbs such as get/list/watch/create/update/delete) over resources at thecluster scope(including cluster-wide resources and optionally namespaced resources across namespaces). AClusterRoleBindingthenbindsthat ClusterRole to a subject (user/group/serviceaccount), making those permissions effective cluster-wide.

This differs from namespace-scoped RBAC objects (RoleandRoleBinding) which apply only within a single namespace. The other options are incorrect becauseClusterObject/ClusterNodeare not RBAC API objects,ValidatingAdmissionPolicybelongs to the admission control API surface (policy enforcement),ResourceQuotais a namespace resource governance object, andContainer/Deploymentare workload/runtime concepts defined in the core/apps APIs rather than authorization primitives.