RBAC in a Shared Kubernetes Cluster: Namespace First, Then Audit What Escalates

Tue, 06 Jan 2026 09:00:00 -0500

This post is for platform teams running multi-tenant Kubernetes on GCP, where several teams share one cluster. RBAC is the isolation control you should design first, because it protects all the others. Below is a default binding pattern and a list of grants to audit. The short version is to scope tenant access to namespaces with RoleBindings that point at a small set of shared ClusterRoles. Then check for escalation paths, not just for who can read what.

Rbac on RLGeeX

RBAC in a Shared Kubernetes Cluster: Namespace First, Then Audit What Escalates