RBAC
Role-based access control
Permissions are granted to roles, and users or services receive permissions by being assigned roles. It is simple to review but cannot by itself express per-object rules such as ownership, which need ABAC or ReBAC checks as well.
- Defined in
- NIST Role Based Access Control project
Covered in
Authorization models: RBAC, ABAC, ReBAC and policy as code you can test
Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS
How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Practice: Privileged container lab: Reject a privileged workload before deployment · NetworkPolicy lab: Lock down a shop namespace · Local project: Secure a real HTTP API · Local project: Verify Kubernetes admission and network boundaries