History

tegwick fb3ac750d5 Add CARING Kubernetes RBAC benchmark		2026-05-23 06:53:30 +02:00
..
access-descriptors.yaml	Add CARING Kubernetes RBAC benchmark	2026-05-23 06:53:30 +02:00
benchmark.yaml	Add CARING Kubernetes RBAC benchmark	2026-05-23 06:53:30 +02:00
caring-mapping.yaml	Add CARING Kubernetes RBAC benchmark	2026-05-23 06:53:30 +02:00
findings-and-canon-pressure.yaml	Add CARING Kubernetes RBAC benchmark	2026-05-23 06:53:30 +02:00
native-concepts.yaml	Add CARING Kubernetes RBAC benchmark	2026-05-23 06:53:30 +02:00
README.md	Add CARING Kubernetes RBAC benchmark	2026-05-23 06:53:30 +02:00

README.md

id	title	status	created_by_workplan
benchmark/caring/kubernetes-rbac/readme	CARING Kubernetes RBAC Benchmark Workspace	candidate	ITC-WP-0010

CARING Kubernetes RBAC Benchmark

This workspace analyzes Kubernetes RBAC as a CARING benchmark, not as a shortcut profile. It is designed to stress access-governance orthogonality across Access Control, Organization, Governance, Security, Landscape, DevSecOps, Network, Observability, Task, and Tagging.

The benchmark keeps Kubernetes native constructs separate from CARING meaning:

Role and ClusterRole are rule bundles or capability profiles, not automatically CARING canonical roles.
RoleBinding and ClusterRoleBinding are grants or assignments.
ServiceAccount is a service subject and a workload identity anchor.
Namespace is a useful scope signal, but it is not automatically a tenant boundary.

Indexed benchmark artifacts:

benchmark.yaml
native-concepts.yaml
caring-mapping.yaml
access-descriptors.yaml
findings-and-canon-pressure.yaml