The cluster was quiet, but kubectl was not. A single command fired off by a non-human identity could spin up pods, change configs, or bring the system down. In Kubernetes, these machine-to-machine actors are as powerful and dangerous as human admins—and often less visible.
Kubectl non-human identities are service accounts, automation tokens, CI/CD pipelines, or bots that interact with the cluster without human intervention. They run deployments, apply manifests, and patch resources on schedule or in response to events. If they are over-permissioned or misconfigured, they become a silent attack vector.
Granting a non-human identity cluster-admin rights is common, fast, and almost always a mistake. The principle of least privilege applies here more than anywhere else. Service accounts should have tightly scoped RBAC roles, limited to specific namespaces and API groups. Rotate their tokens. Monitor their activity. Expire credentials aggressively.
Auditing them is not optional. Use kubectl get serviceaccounts --all-namespaces to list them. Tie each to a known system or pipeline. Remove any that no longer have a clear owner. Review kubectl auth can-i for each account to see exactly what operations it can perform. In production, every extra verb or resource granted is another surface for compromise.