Tenant Boundaries and RBAC That Holds

Why this matters

A deploy key with cluster-admin lives in a CI job for two teams, and a typo in team A's pipeline deletes team B's namespace. The blast radius was identity design, not bad luck: shared over-privileged credentials erase the boundary that namespaces drew. Tenancy fails open by default in every system where nobody tested denial. The L49 lab fixes an over-permissive setup for two fictional teams and proves the fix with negative checks; this lesson explains the shape the fix takes.

Concepts

The boundary has three layers. Namespaces scope names and policies: quotas, network policy defaults, secret stores per tenant. Roles grant verbs on resources inside the boundary (deploy in our namespace, read our config, nothing else). Bindings attach roles to team identities, and the identities should be groups, not individuals: membership changes in the identity provider, never in cluster manifests.

Least privilege is subtractive. Start from what the team demonstrably needs (deploy, roll back, read logs, port-forward for debugging) and grant exactly that; every additional verb needs a written reason with an expiry. Cluster-scoped verbs are guilty until proven innocent: list nodes for debugging is often legitimate, delete is almost never. The classic overreach is star-verbs for convenience during setup that nobody removes; the review that removes them is scheduled, not remembered.

Negative checks are the acceptance test. After every RBAC change, attempt the forbidden actions as each team identity and quote the denials: cross-namespace read, cross-team secret access, cluster-admin verbs. Allowed paths get tested too, because a boundary that blocks legitimate work gets bypassed, and bypasses are worse than the friction they dodge. Denied by default, demonstrated by test, reviewed on schedule.

Worked example

Two fictional teams share a demo cluster with one over-permissive binding each. The learner narrows both to namespace-scoped least privilege, then runs the negative matrix: team A reading team B secrets (denied), team A deploying to team B (denied), team A managing its own releases (allowed). All six denial and allowance results quoted.

Common wrong move

Binding cluster-admin to a shared automation identity because the pipeline needs one privileged step. Scope the step (a narrow role for that verb on that resource), or move the step behind an approval; never hand the whole cluster to a script that runs on every commit.