RBAC — ServiceAccounts, Roles, and the Principle of Least Privilege

Every Pod since Day 5 has been running as the default ServiceAccount with an automounted API token nobody asked for. That token is a credential — and if the webapp container ever gets compromised, the attacker now has it. Fix the leak with two ServiceAccounts: one for the workload (no token at all), one for the observer (a tightly scoped Role). Commit both into the chart, sync via Argo CD, and verify every permission with kubectl auth can-i.