The cluster was live, the stakes high, and one wrong role binding could open a hole wide enough for an attacker to slip through. Kubernetes RBAC guardrails are the first line of control, but only if they are applied with precision. In a VPC architecture with private subnets, those guardrails must work in tandem with secure proxy deployment patterns to keep workloads locked down and unreachable from the public internet.
RBAC in Kubernetes defines who can do what. Without strict role definitions and namespace boundaries, privileged actions can spill across environments. The goal is to design permissions as narrowly as possible, mapping each service account to the exact verbs and resources it needs. Reject wildcards. Audit every binding. Automate enforcement.
When workloads run inside a VPC private subnet, external exposure drops to zero by default. This isolation hardens the network layer, but it also creates new challenges for deployment and connectivity. You cannot simply open ports for convenience. Instead, route all external calls through a controlled proxy service. Deploy this proxy inside the private subnet, ensure it uses mTLS, and control outbound traffic with explicit network policies. This prevents unwanted egress and protects sensitive data leaving the cluster.