Guardrails: least-privilege RBAC for a CI identity and a Kyverno pod baseline
Give the CI service account exactly the rights it needs to roll out Deployments in one namespace, and enforce a pod baseline there with Kyverno: non-root containers and pinned image tags.
Single node · ~16 min · 11 points
- rbac
- kyverno
- policy-as-code
- admission-control
- least-privilege
- security
goldenkube start cnpe-sec-002