Kubernetes RBAC, or role-based access control, decides which users, groups, and service accounts can create, view, update, or delete resources inside a cluster. Permissions are usually granted through Roles or ClusterRoles and attached with RoleBindings or ClusterRoleBindings. It is the main control that prevents a normal user from turning a simple manifest into a cluster-wide change.
RBAC matters because many cloud-native attacks begin with a low-privilege account that can still create custom resources, deploy controllers, or read secrets. If RBAC is too broad, an attacker may place malicious workloads, abuse admission paths, or trigger privileged automation such as Config Connector. Defenders use least privilege, separate namespaces, and regular audits to make sure users can only manage the objects they truly need.