Ensure that the cluster-admin role is only used where required

嚴重等級 1人工審核kubernetes

說明

The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed. The benchmark marks this recommendation Manual.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Obtain a list of the principals who have access to the cluster-admin role by reviewing the clusterrolebinding output for each role binding that has access to the cluster-admin role. kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name Review each principal listed and ensure that cluster-admin privilege is required for it.

修補方式

修補方法: 操作指南或基礎設施修補檔

Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. Where possible, first bind users to a lower privileged role and then remove the clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name]

屬性

作業系統: 不限
標籤: kubernetespoliciesrbac
參考資料: CIS Kubernetes Benchmark v2.1.0 - 5.1.1 Ensure that the cluster-admin role is only used where required