Kubernetes RBAC: Asking for Forgiveness or Getting Permission

This blog post explains Kubernetes RBAC, contrasts it with Linux permissions, and warns that RBAC configurations tend to become overly permissive over time. It advocates enforcing least-privilege, demonstrates how to check permissions (including using `kubectl auth can-i`), and introduces the `who-can` kubectl plugin to help identify which identities can perform specific actions, urging administrators to tighten permissions to reduce compromise risk.