Rbac

• Multi-cluster and tenancy

  Impersonation, watch scoping, single-tenant cluster-admin, and remote clusters.

• RBACDenied

  An apiserver call the controller made — resolving a source, an impersonated apply, or a tenant get — failed with Forbidden or referenced a kind the apiserver does not know.

• Security & multi-tenancy

  Run the controller safely — SOPS decryption, tenant impersonation, remote clusters, admission validation, network policy, and service mesh.