How to Audit Kubernetes RBAC Permissions to Enforce Least-Privilege Access

·61 views

Kubernetes RBAC provides a machine-readable record of every permission in a cluster, yet most clusters accumulate excessive grants over time through debugging sessions, default service accounts, and overly broad Helm charts. Auditors should first identify subjects bound to cluster-admin, those with cluster-wide Secret read access, and any bindings tied to system:authenticated or system:unauthenticated groups. The ability to create Pods or workload objects like Deployments and DaemonSets is a privilege-escalation risk, as it allows mounting service account tokens and running arbitrary code inside the cluster. Default ClusterRoles such as view, edit, and admin are built through label-based aggregation, meaning their effective permissions can expand silently when new ClusterRoles with matching labels are added. Service accounts mounted across many workloads multiply the blast radius of any single compromise, making service account scope and automounting controls critical audit checkpoints.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

RBA Questions AI Productivity Gains as Data Centre Spending Strains Economy

Reserve Bank of Australia Assistant Governor Sarah Hunter told the UBS Australasia Conference in Sydney that evidence of AI meaningfully lifting productivity or reducing employment in Australia is still limited. She noted that data centre capital spending has risen roughly tenfold in recent years, placing demand pressure on the power grid, construction sector and engineering workforce. Hunter warned this investment could fuel persistent inflation and keep interest rates high. She also flagged that shared cloud and foundation model providers create new systemic risks to financial stability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Hackathons Need Scoped Budgets, Not Shared Keys or Cards

AI teams often struggle less with ideas than with a clean way to pay for experiments, and this quickly becomes a developer-experience problem. Default workarounds like shared subscriptions or shared API keys are convenient at first but create security risks, accounting confusion, and unclear ownership. The article proposes treating experimental AI budget as a temporary, bounded capability, similar to short-lived branches or limited tokens. Contributors would receive a defined credit envelope that limits spending without exposing the sponsor's full account or credentials. The author notes that prepaid credits or gift cards can support this model, though rules vary, and that such budgets should still be paired with engineering controls like server-side secrets, input validation, usage logging, and per-user limits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide Explains Using One Free IPv6 /48 Across Two VPS Providers Without Renumbering

A network operator describes how to announce a single IPv6 /48 prefix from two VPS hosts in different cities so both sites can carry traffic. The article recommends setting local-preference and AS-path prepending to make one site primary and the other a backup, while keeping ROA maxLength at /48. It also covers export filters, drain and withdrawal procedures during maintenance, and choosing between anycast and DNS failover for stateless versus stateful services. The piece is written by a leasing company's representative, who discloses that the company's IP space is featured in the walkthrough.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python script flags failing endpoints and slow requests in fictional iPhone log demo

A DEV Community tutorial shows how to build a small Python log analyzer that runs on an iPhone using only the standard library, requiring no server or network connection. The script parses simplified, fictional access-log lines, rejecting malformed entries while keeping their line numbers visible. It counts HTTP 5xx server failures, computes a 30% server-error rate across ten parsed requests, and reports a 195 ms median latency. It also ranks the slowest requests and groups failures by endpoint, with checkout showing the most errors. The author stresses that such summaries point to where to investigate rather than revealing the underlying cause.

0 comments Read more at DEV Community