Quick deck: RBAC least-privilege moves
Recall basic RBAC objects and least-privilege review prompts.
What four nouns belong in an RBAC review? Subject, verb, resource, scope. Who can do what to which resources, and where? RoleBinding versus ClusterRoleBinding The binding often determines blast radius. 'It is temporary cluster-admin for CI.' Permission shortcut Response Let's grant the CI ServiceAccount only the verbs it needs on Deployments in this namespace, then expire or review it after the release. Temporary broad access commonly becomes permanent. It preserves delivery while narrowing blast radius. When is ClusterRole + RoleBinding useful? When you want a reusable permission definition bound narrowly inside one namespace. The definition can be cluster-level without the…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in