Hands-On Microservices with Kubernetes

Granting access to Kubernetes resources as needed

The principle of least privilege directs you to grant access to Kubernetes resources only to services that actually need it (for example, Argo CD). RBAC is a great option here since everything is locked down by default and you can explicitly add privileges. However, beware of falling into the trap of giving wildcard access to everything just to get over difficulties with RBAC configuration. For example, let's take a look at a cluster role with the following rule:

rules:- apiGroups:  - '*'  resources:  - '*'  verbs:  - '*'- nonResourceURLs:  - '*'  verbs:- '*'

This is worse than disabling RBAC because it gives you a false sense of security. Another option for a more dynamic situation is dynamic authentication, ...