Pod Access Control

Configure least-privilege access control for Kubernetes workloads by scoping RBAC bindings, isolating namespaces, enforcing resource quotas, and restricting service exposure.

Service Accounts

Every workload pod must use a dedicated, named service account — not the default service account. Default service accounts often carry excessive privileges and make it impossible to apply fine-grained RBAC per workload.

Required for: all profiles (mandatory)