TMA-GKE-AUTOPILOT-4.1.8

Avoid binding RBAC roles to unauthenticated users and groups

クリティカルレベル 2自動gke-autopilot

説明

Avoid non-default RoleBinding or ClusterRoleBinding objects that grant permissions to the system:anonymous user or the related system:unauthenticated group. These subjects represent unauthenticated Kubernetes API requests and should not receive additional RBAC access to cluster resources. Requires kubectl with cluster-wide read access (KUBECONFIG); system namespaces are excluded and listed resources must be remediated or documented as exceptions. The built-in system:public-info-viewer binding is ignored.

チェック方法

監査方法: シェルコマンド

shell

out=$(kubectl get clusterrolebindings,rolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{range .subjects}}{{if eq .name "system:anonymous"}}{{$b}}{{"\n"}}{{end}}{{if eq .name "system:unauthenticated"}}{{$b}}{{"\n"}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | grep -v '^$' | grep -Evx 'system:public-info-viewer' | sort -u)
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remediate any non-default RoleBinding or ClusterRoleBinding returned by the audit by removing unauthenticated access and replacing it with authenticated, least privilege RBAC access. Bindings to system:anonymous or system:unauthenticated should not be used for normal cluster operations because they can grant Kubernetes API permissions to unauthenticated requests. • Review each returned binding and identify the referenced Role or ClusterRole, including the API groups, resources, and verbs granted. • Delete unnecessary non-default bindings to system:anonymous or system:unauthenticated after confirming they are not required for cluster operation.

プロパティ

オペレーティングシステム: すべて
タグ: gke-autopilotpoliciesrbac
参照: CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v2.0.0 - 4.1.8 Avoid binding RBAC roles to unauthenticated users and groups

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target gke-autopilot --level 2