Ensure that the cluster-admin role is only used where required (RBAC - ClusterRoleBinding)
The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed. Kubernetes provides a set of default roles where RBAC is used. Some of these roles such as cluster-admin provide wide-ranging privileges which should only be applied where absolutely necessary. Roles such as cluster-admin allow super-user access to perform any action on any resource. When used in a ClusterRoleBinding, it gives full control over every resource in the cluster and in all namespaces. When used in a RoleBinding, it gives full control over every resource in the rolebinding's namespace, including the namespace itself.
Risk Level: High
Cloud Entity: Kubernetes Role Binding
CloudGuard Rule ID: D9.TF.K8S.IAM.47
Covered by Spectral: Yes
Category: Security, Identity, & Compliance
GSL LOGIC
kubernetes_cluster_role_binding should not have role_ref.name = 'cluster-admin'
REMEDIATION
Identify all ClusterRoleBindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. Where possible, bind users/groups/service-accounts to a lower privileged role and then remove the ClusterRoleBinding to the cluster-admin role:
kubectl delete clusterrolebinding [name]
Kubernetes Role Binding
A role binding grants the permissions defined in a role to a user or set of users. It holds a list of subjects (users, groups, or service accounts), and a reference to the role being granted. A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide.
Compliance Frameworks
- EKS CloudGuard Best Practices
Updated about 1 year ago