Enforce Least-Privilege RBAC

Replace wildcard access with the exact permissions an auditor needs.

A advanced Linux challenge worth 20 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

Scenario: ServiceAccount auditor has dangerous wildcard access. It only needs get/list on pods and get on configmaps.

Author the minimal Role and RoleBinding in auditor-rbac.yaml. Confirm required reads are allowed and pod deletion is denied with kubectl auth can-i --as system:serviceaccount:default:auditor. Run check when done.