Avoid granting cluster admin level access through the system:masters group

Kako se proverava

Metod provere: Komanda ljuske

out=$(kubectl get clusterrolebindings,rolebindings -A -o go-template='{{range .items}}{{$b:=.metadata.name}}{{range .subjects}}{{if eq .name "system:masters"}}{{$b}}{{"\n"}}{{end}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | grep -v '^$' | grep -Evx 'cluster-admin' | sort -u)
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remediate custom system:masters usage by replacing it with explicit, auditable RBAC assignments. Do not remove the default cluster-admin ClusterRoleBinding to system:masters, because it supports Kubernetes system functionality. Instead, remove custom paths that add users, groups, service accounts, or client certificates to system:masters, and grant required access through least privilege Roles, ClusterRoles, RoleBindings, or ClusterRoleBindings. • Remove any custom RoleBinding or ClusterRoleBinding that references system:masters, after confirming it is not a required system binding • Remove system:masters from identity provider mappings, certificate subject groups, or other external authentication sources used for cluster access • Replace required administrative access with explicit RBAC bindings to cluster-admin only where full cluster access is justified • For most users, groups, ...

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target gke