Cloud & Infrastructure Practical By Samson Tanimawo, PhD Published Jan 4, 2026 4 min read

Kubernetes RBAC Scoping

RBAC misconfigurations grant too much. The scoping pattern that produces tight, reviewable RBAC.

Namespace-scoped

Default: Roles, not ClusterRoles. Bind in the namespace.

ClusterRoles for cluster-wide concerns only (cert-manager, ingress-nginx).

Avoid '*'. List exactly: get, list, watch (read), or create, update, delete (write).

Audit grep: any rules with verbs:['*'] or resources:['*'] is suspect.

Each role: who is bound? Are they still appropriate?

Stale bindings are common; clean up.