Ensure that the cluster-admin role is only used where required

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

This audit reviews Kubernetes ClusterRoleBinding objects in the Oracle OKE cluster to identify principals that are directly granted the cluster-admin ClusterRole. It lists each matching binding and its associated users, groups, or service accounts so the reviewer can verify whether full cluster administrative access is justified. Because OKE uses OCI IAM for access to OKE and the cluster control plane, and Kubernetes RBAC for cluster authorization, this check should be used as a partial review of administrative privilege rather than the sole test of cluster-admin exposure.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Review each ClusterRoleBinding identified by the audit that grants the Kubernetes cluster-admin ClusterRole, and determine whether the listed user, group, or service account still requires full cluster administrative access. In Oracle OKE, this review should also account for access granted through OCI IAM policies and Kubernetes RBAC mappings, because Oracle documents that IAM and the Kubernetes RBAC Authorizer work together to authorize Kubernetes operations. Where responsibilities are limited to a namespace, workload, or operational function, replace cluster administration with a narrower authorization model. • Review each principal returned by the audit and confirm whether full cluster administrative access is still justified for that identity.