Production debugging often relies on broad access, which poses auditing and security risks. This post recommends implementing secure debugging practices in Kubernetes. Key strategies include leveraging least privilege with Role-Based Access Control (RBAC). Short-lived, identity-bound credentials are crucial for session security and accountability. An SSH-style gateway acts as a "front door," making access temporary. An access broker can enhance RBAC, controlling commands and requiring approval. Kubernetes RBAC defines allowed actions, typically granting access to groups, not individuals. Short-lived credentials, like OIDC tokens or client certificates, link sessions to users and expire. These credentials are ideally signed by a regularly rotated certificate authority. A just-in-time access gateway, often over SSH, provides a secure debugging session. The gateway uses the credentials to authenticate the user and then applies policies before interacting with the Kubernetes API. The session's scope can be limited to specific clusters and namespaces.