Keel has permissions to update all deployments in our cluster. Because it runs within the cluster instead of outside (like Travis CI), and the only interaction with Keel is through webhooks, there is no need for finegrained RBAC.
The webhooks only tell Keel that a new image is available, they cannot modify other parts of the Kubernetes deployment directly.
The webhooks only tell Keel that a new image is available, they cannot modify other parts of the Kubernetes deployment directly.