Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster

CaoCấp 1Xem xét thủ cônggke

Mô tả

Roles and ClusterRoles with bind, escalate, or impersonate permissions should be granted only to tightly controlled administrative or platform identities with a documented need. These permissions can allow a subject to expand effective access beyond normal RBAC assignments and should not be included in general user, workload, or automation roles. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Review Role and ClusterRole objects that grant bind, escalate, or impersonate, then trace those roles through RoleBinding and ClusterRoleBinding objects to identify the users, groups, and service accounts that receive the permissions. These verbs should be limited to documented administrative or platform use cases because bind and escalate can grant permissions beyond the caller’s current access, while impersonate can allow API requests as another subject. RBAC permissions are additive, so unnecessary access should be identified and removed.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Replace bind, escalate, and impersonate access with narrowly defined RBAC permissions that support only the approved administrative, platform, or automation function. Remove these verbs from general user, workload, and service account roles unless there is a valid requirement. Review changes before removal to avoid disrupting controllers, operators, CI/CD workflows, or access review processes. • Remove bind, escalate, and impersonate from Roles and ClusterRoles where they are not explicitly required • Replace broad access with least privilege rules that define the exact API groups, resources, verbs, and namespace scope required • Avoid granting RBAC modification permissions such as bind, escalate, create, update, or patch on rbac.authorization.k8s.io resources to service accounts unless specifically justified • Move required elevated access to tightly controlled administrative or ...

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: gkepoliciesrbacfile-permissions
Tham chiếu: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.1.7 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster