Authentication verifies or presents a user’s identity so the user can obtain credentials to access a Kubernetes cluster through kubectl. Authorization is separate: it determines which actions the authenticated user may perform. A platform IAM role can allow cluster authentication without granting permissions inside the cluster; Kubernetes RBAC can then grant precise access. section 12.6
Keep the operational boundary clear:
- Use platform IAM to let a user retrieve cluster credentials. section 12.6
- Use RBAC Roles and RoleBindings to authorize actions within a namespace. section 12.6

































