Avoid binding RBAC roles to unauthenticated users and groups

Cómo se verifica

Método de auditoría: Comando de shell

out=$(kubectl get clusterrolebindings,rolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{range .subjects}}{{if eq .name "system:anonymous"}}{{$b}}{{"\n"}}{{end}}{{if eq .name "system:unauthenticated"}}{{$b}}{{"\n"}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | grep -v '^$' | grep -Evx 'system:public-info-viewer' | sort -u)
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remediate any RoleBinding or ClusterRoleBinding returned by the audit by removing unauthenticated access and replacing it with authenticated, least privilege RBAC access. Bindings to system:anonymous or system:unauthenticated should not be used for normal cluster operations because they can grant Kubernetes API permissions to unauthenticated requests. • Review each returned binding and identify the referenced Role or ClusterRole, including the API groups, resources, and verbs granted • Delete unnecessary bindings to system:anonymous or system:unauthenticated after confirming they are not required for cluster operation.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target gke --level 2