Avoid granting cluster admin level access through the system:masters group

Cómo se verifica

Método de auditoría: Comando de shell

out=$(kubectl get clusterrolebindings,rolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{range .subjects}}{{if eq .name "system:masters"}}{{$b}}{{"\n"}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | grep -v '^$' | grep -Evx 'cluster-admin' | sort -u)
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remediate custom system:masters usage by replacing it with explicit, auditable RBAC assignments. Do not remove the default cluster-admin ClusterRoleBinding to system:masters, because it supports Kubernetes system functionality. Instead, remove custom paths that add users, groups, service accounts, or client certificates to system:masters, and grant required access through least privilege Roles, ClusterRoles, RoleBindings, or ClusterRoleBindings. • Remove any custom RoleBinding or ClusterRoleBinding that references system:masters, after confirming it is not a required system binding • Remove system:masters from identity provider mappings, certificate subject groups, or other external authentication sources used for cluster access • Replace required administrative access with explicit RBAC bindings to cluster-admin only where full cluster access is justified • For most users, groups, ...

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target gke