Handing someone least-privilege access to a Kubernetes cluster means assembling a scoped kubeconfig by hand — ServiceAccount, Role, RoleBinding, token, CA, YAML. Here's the full gauntlet, and how Kubexer collapses it.
A teammate needs to deploy to one namespace. A CI bot needs read-only access to pods and logs. A contractor needs to poke at team-alpha and nothing else.
The right answer is never "here, use my admin kubeconfig." The right answer is a scoped kubeconfig — least privilege, narrow blast radius, easy to revoke. The problem is that creating one by hand is a genuinely tedious ritual that almost nobody enjoys, and that friction is exactly why over-privileged credentials keep leaking into Slack threads and CI secrets.
Let me walk through the full manual process, because the number of moving parts is the whole point.
What "scoped" actually means
