Ensure that the cluster-admin role is only used where required

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

This audit statement identifies the principals that are granted the Kubernetes cluster-admin role by reviewing ClusterRoleBinding assignments in the AKS cluster. It filters the binding output to show each binding name and the associated user, group, or service account, allowing the reviewer to determine which identities have unrestricted cluster-wide administrative access.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Review all ClusterRoleBinding objects that grant access to the Kubernetes cluster-admin role and identify the users, groups, or service accounts associated with each binding. Validate whether each principal still requires full cluster-wide administrative access or whether its responsibilities can be met through a lower-privileged role, preferably a namespace-scoped Role/RoleBinding or a more limited ClusterRole, in accordance with AKS and Kubernetes least-privilege guidance. Where full administrative access is not required, first assign the principal to an approved lower-privilege role and confirm that required operational tasks continue to function as expected. After the replacement access has been validated, remove the unnecessary cluster-admin binding to reduce the risk of privilege escalation and cluster-wide misuse. kubectl delete clusterrolebinding [name]