The CI service account that became cluster-admin
Read cluster role bindings, ask the API what a CI service account can do with kubectl auth can-i, and find the “temporary” binding that gave it every permission.
Briefing
The CI pipeline deploys with the service account ci/deployer. It should only patch deployments. Six days ago a release failed with a permissions error and someone “fixed” it.
kubectl get clusterrolebindings -o wide lists each binding with its subjects. kubectl auth can-i --as=system:serviceaccount:<ns>:<name> asks the authorizer directly, which counts every binding at once.
ops-bastion · Kubernetes review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.