Ensure that the cluster-admin role is not being used

The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed. Kubernetes provides a set of default roles where RBAC is used. Some of these roles such as cluster-admin provide wide-ranging privileges which should only be applied where absolutely necessary. Roles such as cluster-admin allow super-user access to perform any action on any resource. When used in a ClusterRoleBinding, it gives full control over every resource in the cluster and in all namespaces. When used in a RoleBinding, it gives full control over every resource in the rolebinding's namespace, including the namespace itself.

Risk Level: High
Cloud Entity: Kubernetes Role Binding
CloudGuard Rule ID: D9.K8S.AC.06
Covered by Spectral: No
Category: Security, Identity, & Compliance


KubernetesRoleBinding should not have roleRef.name='cluster-admin'


Kubernetes Role Binding

A role binding grants the permissions defined in a role to a user or set of users. It holds a list of subjects (users, groups, or service accounts), and a reference to the role being granted. A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide.

Compliance Frameworks

  • Container Admission Control
  • Container Admission Control 1.0