Kubernetes adds a new set of who-can-do-what questions

Surveys the five Kubernetes security layers, then walks a full least-privilege RBAC example for a CI/CD ServiceAccount.