opa-rbac-templates

Prevent cluster-admin role bindings in Kubernetes by applying OPA templates that block bindings except for approved break-glass accounts. These templates enforce least-privilege RBAC governance at admission control, stopping unauthorized privilege escalation across namespaces.

Restrict dangerous verbs in Kubernetes RBAC by deploying OPA policy templates that explicitly prohibit escalate, bind, and impersonate verbs. This policy-as-code approach prevents privilege escalation attempts during cluster admission control.

Disallow wildcard permissions in Kubernetes RBAC by applying OPA templates that reject resources: ["*"] or verbs: ["*"] configurations. This forces explicit resource and verb definitions, ensuring strict least-privilege enforcement across your cluster.

Yes, you need kubectl and jq as dependencies to apply OPA RBAC templates for Kubernetes governance. These tools facilitate the deployment of policy files like cluster-admin.yaml and wildcards.yaml, supporting ongoing audit references.

Yes, you can create break-glass admin exceptions in OPA policies for Kubernetes. The templates allow specific approved accounts to receive cluster-admin bindings while blocking all other unauthorized attempts, maintaining governance during emergencies.

Use policy-as-code for Kubernetes RBAC audits to automatically block cluster-admin bindings, dangerous verbs, and wildcard permissions. This provides documented policy files and reference implementations, ensuring continuous governance instead of error-prone manual reviews.