Kubernetes RBAC Explained by Breaking It: Practice Roles and Bindings in Your Browser

Your CI service account needs to read pods. Someone writes a ClusterRole called pod-reader, binds it...