Kubernetes RBAC Design overview

Designing and implementing role-based access control in Kubernetes clusters. Covers ClusterRoles, Roles, ClusterRoleBindings, RoleBindings, aggregated roles, and the interaction between RBAC and admission control. Includes least-privilege patterns for workloads, operators, and CI service accounts; multi-tenant RBAC with namespace isolation; and debugging authorization with kubectl auth can-i and audit logs. In extended platforms like Krate, includes org-scoped RBAC layering on top of native K8s RBAC.