Ensure the cluster-admin ClusterRole is only used when required

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Review all Kubernetes RBAC bindings that assign the cluster-admin ClusterRole. This review should include ClusterRoleBinding objects, which grant access across the cluster, and namespaced RoleBinding objects, which can bind the cluster-admin ClusterRole within a specific namespace. List all ClusterRoleBinding subjects bound to cluster-admin: kubectl get clusterrolebindings -o json \ | jq -r ' ["BINDING", "SUBJECT_KIND", "SUBJECT_NAME", "SUBJECT_NAMESPACE"], ( .items[] | select(.roleRef.kind=="ClusterRole" and .roleRef.name=="cluster-admin") | .metadata.name as $binding | ...

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

For each cluster-admin binding, replace broad access with a least privilege Role or ClusterRole that grants only the required API groups, resources, and verbs. Bind the replacement role to the approved user, group, IAM service account, or Kubernetes ServiceAccount first, validate access, and then remove the unnecessary cluster-admin binding. • Identify all ClusterRoleBinding and RoleBinding objects that assign the cluster-admin ClusterRole, including both cluster wide and namespace level bindings. • Review each bound user, group, IAM service account, or Kubernetes ServiceAccount to confirm whether full administrative access is still required and documented. • Replace cluster-admin access where possible with a least privilege Role or ClusterRole that grants only the required API groups, resources, and verbs.