Kubernetes RBAC Security: Why Least Privilege Must Extend to Container Images
Kubernetes RBAC is well understood. Grant the minimum permissions each service account needs. Avoid cluster-admin. Audit role bindings regularly. The least-privilege principle is clear. What’s less clearly understood is that RBAC applies to Kubernetes API access—what Kubernetes resources a pod can interact with. It doesn’t apply to what happens inside the container. An application running
