Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Authorization Models: RBAC, ABAC, ReBAC and Permission-Based Design in Multi-Tenant Scenarios
Stuffing conditions into roles leads to role explosion; the fix is to use RBAC, ABAC and ReBAC as layers. We reduce roles to permission bundles, write the refund rule as a policy that returns reasoned decisions from tenant, limit and time attributes, show the Zanzibar idea with a toy relationship graph, pin it all with tests, and discuss permissions in tokens, the tenant claim and auditing impersonation.
Kubernetes Security: ServiceAccounts, RBAC, Pod Security Standards, securityContext and NetworkPolicy
Give every app its own ServiceAccount, don't mount the token unless needed, protect the namespace with restricted Pod Security Standards, and after a default deny NetworkPolicy open only the paths you need. With real kind output we test RBAC with kubectl auth can-i, catch the aspnet:10.0 image running as root, see what readOnlyRootFilesystem does to .NET Data Protection, try user namespaces and hit a default deny that forgot DNS.