How I Built a Production-Grade Kubernetes RBAC Setup — And Broke It On Purpose

Most RBAC tutorials show you how to apply a Role and run kubectl auth can-i . Then they call it done. That never sat right with me. In production, your workload doesn't authenticate using your kubeconfig. It authenticates using a ServiceAccount token mounted inside the pod. So if you've never tested RBAC from inside a running container, you haven't actually tested RBAC. This project fixes that. I built a minimal but realistic RBAC setup for an observability tool, validated it from inside a live deployment, and then intentionally broke it to understand what failure actually looks like at the API server level. The full source is here: github.com/adil-khan-723/K8s-RBAC The Setup Everything lives inside a dedicated observability namespace. The workload — a test deployment — runs under a purpose-built ServiceAccount called log-reader-sa . A namespace-scoped Role defines exactly what that identity is allowed to do. A RoleBinding connects the two. observability (namespace) │ ├── log-reader-sa