RBAC explainer
Read Roles and bindings in plain words: who can do what, where, and which permissions are risky.
Runs locally. Nothing you paste leaves this tab.
How RBAC scope works
A Role lives in one namespace. A ClusterRole is a reusable set of rules. What matters is the binding: a RoleBinding grants the role inside its own namespace, even when it points at a ClusterRole; a ClusterRoleBinding grants it in every namespace and on cluster-scoped objects such as nodes.
Permissions that are worth more than they look
list on Secrets returns their values, not just names. Creating pods or Deployments lets someone mount any Secret or service account in the namespace. pods/exec, escalate, bind, impersonate and nodes/proxy are all paths to more access.
kubectl auth can-i --list --as=system:serviceaccount:ci:github-actions -n prod
kubectl auth can-i get secrets --as=jane@example.com -n prod