Improving Your Kubernetes Authorization: Don’t Use system:masters

This note explains that the Kubernetes built-in group system:masters is hardcoded to provide unrestricted cluster-admin privileges, making any credentials associated with it effectively long-lived backdoors (notably client certificate credentials like admin.conf). It recommends avoiding granting users membership in system:masters, using clusterrolebindings to grant revocable admin rights when needed, and tightly controlling bootstrap/admin credentials to reduce the risk of unauthorized cluster access.