Kubernetes has become a core substrate for digital service platforms, where multiple teams, tenants, and automation components share the same control plane. In this setting, authorisation is a central security control because it governs API operations that can expose sensitive data, change runtime behaviour, or disrupt availability. Enforcing least privilege in Kubernetes is challenging in practice: the authorisation surface is broad, policies evolve continuously, and automation identities frequently act with privileges that can amplify the impact of misconfiguration or compromise. This paper compares Kubernetes authorisation mechanisms, covering native options (Role-Based Access Control [RBAC], Attribute-Based Access Control [ABAC], and Authorization Webhooks) together with representative open-source approaches that enable more expressive models, namely Open Policy Agent (OPA) and SpiceDB. The analysis is grounded in operational requirements typical of shared clusters, including delegated administration, constrained access to sensitive resources, least-privilege automation, and controlled administrative operations. Mechanisms are evaluated through a unified framework that captures
📖 افتح في inklap 🔗 DOI 📮 اطلب بحثاً