Most Kubernetes clusters are running cluster-admin bindings that started as "temporary."
Temporary three years ago.
Wrote up how to find them and fix them without breaking prod, for Teleport: https://goteleport.com/blog/how-to-reduce-overprivileged-kubernetes-service-accounts/
What's the oldest "temporary" RBAC workaround still running in your environment?