Which Kubernetes object is used to grant permissions to a cluster-wide resource?

In Kubernetes Role-Based Access Control (RBAC), permissions are defined by Role or ClusterRole objects and granted by RoleBinding or ClusterRoleBinding objects. A ClusterRole defines permissions on cluster-scoped resources (e.g., nodes) or on namespaced resources across all namespaces. To grant these cluster-wide permissions to a user, group, or service account, a ClusterRoleBinding is required. It binds a subject to a ClusterRole, making the permissions effective across the entire cluster.

A. RoleBinding: This object grants permissions only within a specific namespace. It cannot be used to grant access to cluster-wide, non-namespaced resources.
C. RoleReference: This is not a standalone object but a field within a RoleBinding or ClusterRoleBinding that points to the Role or ClusterRole being granted.
D. ClusterRoleAccess: This is not a valid or recognized object type in the Kubernetes RBAC API. It is a fabricated term. ---

1. Kubernetes Official Documentation, "Using RBAC Authorization":

Reference for Correct Answer (B): In the section "RoleBinding and ClusterRoleBinding," the documentation states, "A role binding grants the permissions defined in a role... To grant permissions at a cluster scope, you can use a ClusterRoleBinding." It further clarifies, "A ClusterRoleBinding may be used to grant the permissions defined in a ClusterRole to users across the entire cluster."

Reference for Incorrect Answer (A): The same section specifies, "A RoleBinding grants permissions within a specific namespace."

Reference for Incorrect Answer (C): The YAML examples for RoleBinding and ClusterRoleBinding show roleRef as a required field, not a top-level object.

2. VMware Tanzu Kubernetes Grid 1.5 Documentation, "Configure Authorization for a Tanzu Kubernetes Cluster":

Reference for Correct Answer (B): Under the section "About Roles and Permissions," it describes the standard Kubernetes RBAC objects. It explains that a ClusterRoleBinding is used to grant a ClusterRole to all namespaces in the cluster, confirming its cluster-wide scope. This aligns with the upstream Kubernetes model used in VMware's products.