Ensure that the cluster-admin role is only used where required

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

This audit statement identifies the principals that are granted the Kubernetes cluster-admin role by reviewing ClusterRoleBinding assignments in the AKS cluster. It filters the binding output to show each binding name and the associated user, group, or service account, allowing the reviewer to determine which identities have unrestricted cluster-wide administrative access.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Review all ClusterRoleBinding objects that grant access to the Kubernetes cluster-admin role and identify the users, groups, or service accounts associated with each binding. Validate whether each principal still requires full cluster-wide administrative access or whether its responsibilities can be met through a lower-privileged role, preferably a namespace-scoped Role/RoleBinding or a more limited ClusterRole, in accordance with AKS and Kubernetes least-privilege guidance. Where full administrative access is not required, first assign the principal to an approved lower-privilege role and confirm that required operational tasks continue to function as expected. After the replacement access has been validated, remove the unnecessary cluster-admin binding to reduce the risk of privilege escalation and cluster-wide misuse. kubectl delete clusterrolebinding [name]