Security & multi-tenancy

How to run JaaS without granting it broad cluster power and how to constrain what it can reach. In operator mode, snippets resolve under a tenant ServiceAccount, so a snippet can do exactly what its RBAC allows and no more.

• Tenancy and RBAC — tenant impersonation and the permissions the operator needs.
• Admission webhook — validate resources at admission time.
• Network policy — lock JaaS’s traffic down to what it needs.
• Service mesh — run JaaS inside a mesh.