Avoid granting cluster admin level access through the system:masters group

How it is checked

Audit method: Shell command

out=$(kubectl get clusterrolebindings,rolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{range .subjects}}{{if eq .name "system:masters"}}{{$b}}{{"\n"}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | grep -v '^$' | grep -Evx 'cluster-admin' | sort -u)
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Remediate custom system:masters usage by replacing it with explicit, auditable RBAC assignments. Do not remove the default cluster-admin ClusterRoleBinding to system:masters, because it supports Kubernetes system functionality. Instead, remove custom paths that add users, groups, service accounts, or client certificates to system:masters, and grant required access through least privilege Roles, ClusterRoles, RoleBindings, or ClusterRoleBindings. • Remove any custom RoleBinding or ClusterRoleBinding that references system:masters, after confirming it is not a required system binding • Remove system:masters from identity provider mappings, certificate subject groups, or other external authentication sources used for cluster access • Replace required administrative access with explicit RBAC bindings to cluster-admin only where full cluster access is justified • For most users, groups, ...

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke