Kubernetes permissions compose in ways that are easy to miss: list on Secrets returns their contents, escalate and bind let a user grant rights they lack, and a Helm chart can add a ClusterRole nobody reviewed. Effective access is the union of every configured authorizer, and kubectl auth can-i --list only shows RBAC.
- Grant each person and service account the narrowest role, namespace and verbs it needs; avoid
cluster-admin, wildcards and the built-ineditandadminroles for everyday work. - Treat
listandwatchon Secrets,nodes/proxy,escalate,bind,impersonateandpatchon namespaces as privileged, and review every grant of them. - Review the RBAC that third-party charts and operators install, including ClusterRole aggregation labels.
- Audit every authorizer the cluster uses, such as a managed provider's access policies, not just RBAC, and give administrators time-bound elevated access instead of standing rights.
Guides on this site
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS
How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Practice
- Privileged container lab: Reject a privileged workload before deployment · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- Verify Kubernetes admission and network boundaries · Local project
Gaps on this site
The guides cover service account RBAC, read access to Secrets and managed providers' access policies. No guide here covers just-in-time administrator access to a cluster or reviewing the RBAC that Helm charts and operators install.
References
- K02:2025 Overly Permissive Authorization Configurations (OWASP)
- Kubernetes documentation: Role Based Access Control Good Practices
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.