An audit of citadel-p0h1kt found four problems. Fix all of them; the order is yours.

kubectl get clusterrolebindings | grep ci
kubectl get rolebindings,serviceaccounts -n citadel-p0h1kt
kubectl get deploy,pods -n citadel-p0h1kt

1. The CI account owns the cluster

Someone bound the ServiceAccount ci to cluster-admin with a ClusterRoleBinding named ci-admin. Remove that binding. CI still has to deploy into this namespace: give it edit here, with a RoleBinding named ci-edit.

kubectl auth can-i delete nodes --as system:serviceaccount:citadel-p0h1kt:ci
kubectl auth can-i create deployments --as system:serviceaccount:citadel-p0h1kt:ci -n citadel-p0h1kt

The first must become no and the second must stay yes.

2. The developers can see nothing

The group developers has no bindings at all. They need to read the namespace, Secrets excluded. The built-in view ClusterRole, bound here with a RoleBinding named dev-view, is exactly that.

3. market-api cannot start

kubectl describe rs -l app=market-api -n citadel-p0h1kt | tail -5

Its template names a ServiceAccount that does not exist. Create it; the ReplicaSet retries by itself.

4. The audit Pod runs as root

~/citadel-p0h1kt/audit.yaml defines Pod audit. Make it run as uid 1000 with a read-only root filesystem, delete the old Pod and apply the file.

kubectl exec audit -n citadel-p0h1kt -- id

The last objective asks which command answers a permission question without performing the action.