What is k8s-rbac-quota?

A troubleshooting guide for Kubernetes access permissions and resource limits. Kubernetes is software for running and managing containers, while RBAC controls who can do what and ResourceQuota limits resource usage.

Use it to diagnose, repair, and verify Kubernetes RBAC and ResourceQuota problems.

It helps find and fix permission-denied errors and cases where a Kubernetes namespace has exceeded its allowed resource quota, then check that the fix worked.

k8s-rbac-quota — Skill for Claude Code and Codex by kudig-io

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add kudig-io/kudig-database --skill k8s-rbac-quota

Clone the repo

git clone --depth 1 https://github.com/kudig-io/kudig-database

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/kudig-io/kudig-database/k8s-rbac-quota/github.svg)](https://agentmods.dev/skills/kudig-io/kudig-database/k8s-rbac-quota)

Your own site

<a href="https://agentmods.dev/skills/kudig-io/kudig-database/k8s-rbac-quota"><img src="https://agentmods.dev/badge/skills/kudig-io/kudig-database/k8s-rbac-quota/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/kudig-io/kudig-database/k8s-rbac-quota"><img src="https://agentmods.dev/badge/skills/kudig-io/kudig-database/k8s-rbac-quota.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 22 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 7,293 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00022	$0.07293
Opus 5.5	$0.00009	$0.02917
Sonnet 5.5	$0.00004	$0.01459
Haiku 4.5	$0.00002	$0.00729

Measured 1mo ago against content hash e17ed33fad66, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

k8s-rbac-quota scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/diagnose-quick.sh, scripts/verify-rbac.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

19-故障诊断/08-技能体系/skill-set/k8s-rbac-quota/SKILL.md · 617 lines

How it starts

The opening of the file, as written. The whole thing — 617 lines — stays where its author put it; the contents beside it link to each section on GitHub.

生产环境安全提示

本文档包含可直接执行的运维命令。执行前请确认：当前目标集群与 Namespace 是否正确；是否具备足够的 RBAC 权限；是否已在非生产环境验证。命令风险等级标注：🔴 高风险（可能造成数据丢失或服务中断）、🟡 中风险（会修改集群状态，但通常可回滚）、🟢 低风险/只读（信息收集，无副作用）。

K8s RBAC & Quota Failure 诊断与修复

RBAC 和 ResourceQuota 问题是 [[kubernetes|Kubernetes]] 中导致 Pod 创建失败、应用功能异常的常见根因。权限配置错误可能在 CI/CD 发布、新服务部署、集群升级后暴露。

本 [[SKILL|Skill]] 覆盖 RBAC 权限不足、ResourceQuota 超限、ServiceAccount 缺失等全部常见根因的诊断和修复。

何时使用此 Skill

症状	检测方法	置信度
Pod 事件显示 `forbidden`	`kubectl describe pod <pod>` Events	0.95
API 调用返回 403	应用日志或 kubectl 输出	0.95
`ResourceQuota exceeded` 事件	`kubectl get events --field-selector reason=FailedCreate`	0.90
ServiceAccount 不存在	`kubectl get sa -n <ns>`	0.95
ClusterRoleBinding 缺失	`kubectl get clusterrolebinding`	0.85

排除条件: 网络不通 → SKILL-NET-001; 节点问题 → SKILL-NODE-001

快速分级（2 分钟内完成）

影响范围
├── 核心服务无法创建 Pod ──────→ P0（15min 内修复）
├── CI/CD 流水线失败 ──────────→ P1（30min 内修复）
├── 新服务首次部署失败 ────────→ P2（2h 内修复）
└── 测试环境权限问题 ──────────→ P3（4h 内处理）

立即升级条件:

核心服务 ServiceAccount 被误删除
ClusterRole 被误修改导致多个服务受影响
安全事件怀疑权限提升攻击

执行流程

# 🟢 低风险：只读/信息收集，通常无副作用
工单/告警触发
    │
    ▼
┌──────────────┐    脚本: scripts/diagnose-quick.sh
│ Phase 1      │    内容: kubectl 快速检查（只读）
│ 快速检查      │    Step: D1.1-D1.5
└──────┬───────┘
       │ 确认根因
       ▼
┌──────────────┐    参考: reference/remediation-playbook.md
│ 修复操作      │    风险: LOW → MEDIUM → HIGH
│ REM-001~006  │
└──────┬───────┘
       │
       ▼
┌──────────────┐    脚本: scripts/verify-rbac.sh
│ 验证确认      │    检查: 权限/配额/事件
└──────────────┘

可用脚本

脚本	用途	参数	风险
`scripts/diagnose-quick.sh`	kubectl 快速诊断	`NAMESPACE` `RESOURCE_TYPE` `RESOURCE_NAME`	只读
`scripts/verify-rbac.sh`	修复后验证	`NAMESPACE` `SERVICE_ACCOUNT`	只读

根因概览 (6 种)

RC ID	根因	概率	首选修复	风险
RC-001	Role/ClusterRole 权限不足	高	REM-001 更新 Role	LOW
RC-002	ResourceQuota 超限	高	REM-002 调整配额	LOW
RC-003	ServiceAccount 不存在	中	REM-003 创建 SA	LOW
RC-004	RoleBinding/ClusterRoleBinding 缺失	中	REM-004 创建 Binding	LOW
RC-005	[[networkpolicy\|NetworkPolicy]] 阻止 API 访问	低	REM-005 调整策略	MEDIUM
RC-006	PodSecurityPolicy/Admission 拒绝	中	REM-006 调整策略	HIGH

Read the full file on GitHub · 617 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · +19 lines e17ed33fad66
1mo ago First seen · 598 lines · 22 tokens per session scan A 0fa6eb10669b

Subscribe to this mod's changes

k8s-rbac-quota is a skill published in the GitHub repository kudig-io/kudig-database (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 22 tokens to every session and 7,293 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Containers Debugging DevOps and cloud Kubernetes-Incident-Response aiops authorization clusterrole k8s rbac resourcequota role runbook serviceaccount skills sop

networkpolicy-debug

Diagnose NetworkPolicy-related connectivity issues (traffic unexpectedly blocked, default-deny effects, egress blocking DNS). Identifies which NetworkPolicies affect a pod, checks ingress/egress rules, and verifies CNI support.

scitix/siclaw · 48 tokens

statefulset-debug

Diagnose StatefulSet rollout and scaling failures (ordered update stuck, OnDelete not updating, partition misconfiguration, PVC binding deadlocks). Checks update strategy, pod ordinal progression, PVC bindings, and ordered startup to identify why a StatefulSet is not progressing.

scitix/siclaw · 56 tokens

k8s-rbac-quota