Kubernetes RBAC configured with minimal permissions; no wildcard verbs or cluster-admin

Wildcard verbs (verbs: ['*']) or cluster-admin bindings grant a service account the ability to read secrets, delete deployments, modify RBAC rules, or escalate its own privileges — effectively root access on the cluster (CWE-284, OWASP A01). NIST 800-53 AC-6 requires least-privilege access control. CIS Kubernetes 5.1.1 explicitly prohibits wildcard verbs and cluster-admin bindings for workload service accounts. A compromised pod with cluster-admin can exfiltrate every secret in the cluster within seconds.

Audit existing RBAC with kubectl get clusterrolebindings,rolebindings -A -o yaml | grep -A5 cluster-admin and replace over-permissive roles with narrow, explicit ones. Replace wildcard roles in k8s/rbac.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: api-role
  namespace: production
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["secrets"]
    resourceNames: ["db-credentials"]
    verbs: ["get"]

For every service account, ask: what specific API calls does this workload make? Grant only those verb-resource pairs. Use kubectl auth can-i --list --as=system:serviceaccount:<ns>:<sa> to audit effective permissions.