CAST AI Least-Privilege Review

Overview

Review permissions against the components actually enabled. Distinguish observation, optimization, operator lifecycle, Kvisor telemetry, optional cluster proxy, and cloud-provider access instead of labeling the entire installation read-only or full-access.

Prerequisites

• Selected umbrella-chart mode and optional features
• Rendered Helm resources, service accounts, RBAC, cloud IAM, and secret references
• Organization roles, API-key inventory, network policy, and data-classification rules

Instructions

Step 1: Establish feature scope

Use Read and Grep to map read-only, Workload Autoscaler, Node Autoscaler, full, Kvisor options, reliability metrics, GPU or storage telemetry, operator management, and cluster proxy. Flag enabled components that lack a named business owner.

Step 2: Review identity boundaries