Least privilege in OpenShift is not optional. It is the foundation of a secure, stable cluster. It forces every process, service account, and human user to run only with the permissions they truly need—no more.
OpenShift gives you Role-Based Access Control (RBAC) and Security Context Constraints (SCCs) to enforce least privilege. RBAC defines what actions a subject can take on which resources. SCCs define the security settings under which pods run, such as whether they can run as root or mount host paths. Used together, they shrink the attack surface and slow the blast radius of any compromise.
To apply least privilege in OpenShift, start with a deny-by-default policy. Grant roles only for specific resources and verbs. Bind them to service accounts or users who require those permissions for a defined workload. Audit role bindings monthly. Remove stale or unused accounts.
Lock down SCCs. Avoid anyuid unless absolutely necessary. Use restricted as the default. Require explicit approval for elevated constraints. Review pod specs for unnecessary capabilities or volume mounts.