k8s-rbac-audit

/k8s-rbac-audit

Focused audit of Kubernetes RBAC configuration, identifying overly permissive roles and privilege escalation paths.

Trigger

Use when you need to:

• Audit who has access to what in a Kubernetes cluster
• Identify overly permissive roles and role bindings
• Find privilege escalation paths through RBAC
• Review RBAC after organizational changes (team restructuring, offboarding)
• Prepare for a security review focused on access control

Input

One of:

• Live cluster: kubectl access with RBAC read permissions
• RBAC manifests: Role, ClusterRole, RoleBinding, ClusterRoleBinding YAML files
• Helm charts: Charts defining RBAC resources
• Specific scope: Focus on a namespace, team, or service account

Process

Phase 1: Cluster-Level RBAC

1. cluster-admin bindings

   kubectl get clusterrolebindings -o json | jq -r '
     .items[] |
     select(.roleRef.name == "cluster-admin") |
     "Binding: \(.metadata.name)\nSubjects: \(.subjects | map(.kind + ":" + .name) | join(", "))\n"'
   

   • Every cluster-admin binding (should be minimal -- operators, break-glass only)
   • system:masters group members (equivalent to cluster-admin, cannot be restricted by RBAC)

2. Overprivileged ClusterRoles

   kubectl get clusterroles -o json | jq -r '
     .items[] |
     select(.rules[]? | .resources[]? == "*" and .verbs[]? == "*") |
     .metadata.name'
   

   • ClusterRoles with * on all resources and all verbs
   • ClusterRoles with create on pods or deployments (code execution)
   • ClusterRoles with access to secrets across all namespaces

3. Dangerous permission combinations

   • create pods + get secrets = create a pod that mounts any secret
   • create pods + create serviceaccounts + create rolebindings = escalate to any role
   • patch nodes = modify node labels to bypass nodeSelector constraints
   • impersonate users/groups = act as any user
   • escalate on roles = create roles with more permissions than you have
   • bind on roles = bind any role to any subject