Skip to Main Content
Lightning Talk Beginner

RBAC Decides Who, Kyverno Decides What: Practical Kubernetes Admission Security

Proposal status is Rejected
Session Description

Lets assume your cluster's RBAC is locked down i.e. a CI service account can only create Pods in its namespace. Sadly, its still not safe. RBAC decides who can act, but not what's inside what they ship: that same "create Pods" right lets a leaked token launch a privileged, host-mounting, root pod that owns the node.

PodSecurityPolicy was removed in Kubernetes v1.25, and Pod Security Admission's built-in profiles can't express rules like "images only from our registry" or "always set resource limits." In this lightning talk I'll show one quick escalation, then stop it cold with Kyverno : the OSS policy-as-code engine that just graduated CNCF in March 2026 and writes policies in plain YAML. You'll leave with a starter pack: least-privilege RBAC plus a Kyverno baseline mapped to the Restricted Pod Security Standard, deployable in audit mode the same afternoon.

Key Takeaways

  • Why RBAC alone can't secure a cluster : the gap between "who can act" and "what they can deploy."

  • One Kyverno policy that blocks the privileged-pod escalation, in plain YAML.

  • A take-home RBAC + Kyverno starter pack you can run in audit mode today.

References

https://cncf.io/projects/kyverno

Session Categories

Introducing a FOSS project or a new version of a popular project
Tutorial about using a FOSS project

Which track are you applying for?

Security

Speakers

Sky Singh
Sky Singh Devops | Sabi

I'm Akash Singh, known as SkySingh04 online. I specialize in DevOps, MLOps and Golang.

I currently handle all things related to DevOps and Infra at FinalroundAI, and work as a DevOps and MLOps Engineer at Sabi. I have previously worked as a DevOps Engineer at Aspora and Embeddings Co. where I worked with AWS, Terraform and Infrastructure as Code, and as a Backend Engineer at CloudSek with my work primarily focusing on Golang and microservices. I'm a Kubestronaut, holding all 5 CNCF Kubernetes certifications [CKA, CKAD, CKS, KCNA and KCSA] and a big believer in all things Kubernetes.

I am active within the Open Source community. I run my own open source community called Point Blank, organize the Cloud and DevOps devroom at IndiaFOSS, and was selected for Google Summer of Code 2024 with Keploy and the Linux Foundation Mentorship 2025 with LitmusChaos.

I was the team leader for Hackglobal Hackathon 2024 which happened in Singapore. I have also participated and won in 7 other hackathons, winning and getting podium finishes all through. I regularly volunteer as a mentor and judge for various hackathons as well. I also attended ACM Winter School 2024.

I have also actively worked as a teacher, trainer and international speaker, both professionally at SwipeGen and CodingZen, and during club meetings as the Team Lead at Point Blank as since I genuinely enjoy talking about tech and sharing my knowledge with peers and juniors alike.

You'll find me with a mic in my hand emceeing on stage or winning Public Speaking Events across India.

https://www.linkedin.com/in/skysingh04/