← All posts

Category · 2 posts

Platform Engineering

Kubernetes as a platform for teams: multi-tenant RBAC, workload identity, network policy, golden paths.

November 2026

Default-deny network policies for tenant isolation on GKENetwork policies leave everything open until a policy selects a pod. Here is the order I'd roll them out in on GKE, and where they stop protecting you.

January 2026

RBAC in a Shared Kubernetes Cluster: Namespace First, Then Audit What EscalatesSome RBAC grants that look harmless give a tenant far more than intended. Here is the default binding pattern I'd use and the permissions to check before anything else.