RBAC

Setting Up Kubernetes RBAC: The Roles and RoleBindings That Actually Enforce Least Privilege

by
Setting Up Kubernetes RBAC: The Roles and RoleBindings That Actually Enforce Least Privilege

By KP  |  TZoneLabs  |  DevOps & Cloud Engineering A Role scoped to one namespace, bound to one service account, with verbs limited to exactly what that workload does, is what turns Kubernetes RBAC into an actual security boundary instead of a checkbox. Most clusters we’ve audited get this half right: the Role exists, but … Read more

Kubernetes RBAC Setup: A Practical Guide (No More Guessing Permissions)

by
Kubernetes RBAC Setup: A Practical Guide (No More Guessing Permissions)

By KP  |  TZoneLabs  |  DevOps & Cloud Engineering The fastest way to grant a pod too much power in Kubernetes is kubectl create clusterrolebinding temp –clusterrole=cluster-admin –serviceaccount=default:default. It works immediately, which is exactly the problem. Nobody circles back to fix it, and six months later a compromised pod can read every secret in the … Read more