atelier/domains/kubernetes/rbac.md

RBAC and Pod Security — Derived Rules

Derives from domains/kubernetes/first-principles.md. P7 (RBAC by Intent, Not Identity) lives here. Cross-link domains/security/authorization.md for the general authorization principles and domains/security/secrets.md for secret handling.

RBAC Objects (P7 RBAC by Intent, Not Identity)

• Role — permissions within a namespace (verb on resource). ClusterRole — permissions cluster-wide or usable across namespaces.
• RoleBinding — binds a Role to a subject (ServiceAccount, User, Group) within a namespace. ClusterRoleBinding — binds a ClusterRole cluster-wide.
• Prefer Role + RoleBinding per namespace over ClusterRole + ClusterRoleBinding. Cluster-level is the broad axe; namespace-level is the scalpel.

Bind to Service Accounts, Not Users (P7 RBAC by Intent, Not Identity)

• A workload authenticates as a ServiceAccount. Bind the Role to the ServiceAccount, scoped to the workload's namespace.
• The Role encodes the workload's intent: "this workload reads ConfigMaps in this namespace." Not "this user is an admin."
• One ServiceAccount per workload (or workload family). Do not reuse the default ServiceAccount for production workloads; it is a shared identity.

Least Privilege (P7 RBAC by Intent, C1 Correctness via security)

• Grant the minimum verbs on the minimum resources. get, list, watch on pods is fine for a monitoring sidecar; * on * is not.
• cluster-admin is a smell. If a workload "needs" cluster-admin, the workload is either doing something it should not, or it is a cluster operator that should be reviewed as such.
• Audit ClusterRoleBindings regularly. They are the broadest grant in the system and the easiest to leave behind.

Pod Security Standards and Admission (P7 RBAC by Intent, security)

• Pod Security Standards (PSS) define three profiles: privileged (unrestricted), baseline (some restrictions), restricted (hardened).
• Pod Security Admission (built-in) enforces a PSS profile per namespace via labels: pod-security.kubernetes.io/enforce: restricted. It replaces the deprecated PodSecurityPolicy.
• Map namespaces to profiles: restricted for prod workloads, baseline for most, privileged only for system add-ons (CNI, CSI, node agents) that need it. A workload in privileged is a security event, not a default.

Service Accounts and Token Automation (P9 Config and Secrets are Separate)

• ServiceAccount tokens are auto-mounted into pods unless automountServiceAccountToken: false. For workloads that do not call the API, disable auto-mount.
• Long-lived ServiceAccount tokens are deprecated. Use projected tokens (bound to the pod, time-limited) via TokenRequest.
• A workload that does not need API access should not have a token. A workload that needs API access should have a Role scoped to its intent.

What Violates RBAC Discipline

Violation	Principle
cluster-admin bound to a workload	P7 RBAC by Intent, Not Identity
Reused default ServiceAccount for prod	P7 RBAC by Intent, Not Identity
automountServiceAccountToken: true on a non-API workload	P9 Config and Secrets are Separate
privileged PSS on an application namespace	P7 RBAC by Intent, security
ClusterRoleBinding where a RoleBinding would suffice	P6 Namespaces Bound Blast Radius, P7
Long-lived static token instead of projected	P9 Config and Secrets are Separate
Leftover ClusterRoleBindings after a workload is removed	P7 RBAC by Intent (audit)