[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HC6KWSGG84CXCYDEXC83MD":3,"skill-same:01M6HC6KWSGG84CXCYDEXC83MD":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":65,"commitSha":66,"skillDirectory":67,"forksCount":68,"repositoryHtmlUrl":69,"repositoryHomepageUrl":6,"ownerHtmlUrl":70,"ownerBlogUrl":6,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6HC6KWSGG84CXCYDEXC83MD","auditing-kubernetes-cluster-rbac",null,"Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fauditing-kubernetes-cluster-rbac\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"rbac","cluster","auditing kubernetes cluster rbac","kubernetes","kubectl","kubeaudit","privilege escalation","paths","de","cm","access","t1098","t1078","aks","gke","eks","cloud-security","permissions","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: auditing-kubernetes-cluster-rbac\ndescription: 'Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- kubernetes\n- rbac\n- access-control\n- eks\n- gke\n- aks\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1098.006\n- T1552.007\n- T1611\n- T1613\n- T1078.004\ncategory: auditing-kubernetes-cluster-rbac\n---\n# Auditing Kubernetes Cluster RBAC\n\n## When to Use\n\n- When performing security assessments of Kubernetes clusters (EKS, GKE, AKS, or self-managed)\n- When validating that RBAC policies enforce least privilege for users and service accounts\n- When investigating potential lateral movement or privilege escalation within a Kubernetes cluster\n- When compliance audits require documentation of access controls and permissions\n- When onboarding new teams to a shared cluster and defining appropriate RBAC policies\n\n**Do not use** for network policy auditing (use Cilium or Calico network policy tools), for container image scanning (use Trivy or Grype), or for runtime security monitoring (use Falco or Sysdig Secure).\n\n## Prerequisites\n\n- kubectl configured with cluster-admin or equivalent read permissions to the target cluster\n- rbac-tool installed (`kubectl krew install rbac-tool` or binary from GitHub)\n- KubiScan installed (`pip install kubiscan`)\n- Kubeaudit installed (`brew install kubeaudit` or from GitHub releases)\n- Access to the cluster's audit logs for correlating RBAC findings with actual API access\n\n## Workflow\n\n### Step 1: Enumerate ClusterRoles and Roles with Dangerous Permissions\n\nIdentify roles with wildcard permissions, secret access, pod exec, or escalation capabilities.\n\n```bash\n# List all ClusterRoles with wildcard verb access\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        verbs = rule.get('verbs', [])\n        resources = rule.get('resources', [])\n        if '*' in verbs or '*' in resources:\n            print(f'ClusterRole: {name}')\n            print(f'  Verbs: {verbs}')\n            print(f'  Resources: {resources}')\n            print(f'  API Groups: {rule.get(\\\"apiGroups\\\", [])}')\n            print()\n\"\n\n# Find roles that can read secrets\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        verbs = rule.get('verbs', [])\n        if ('secrets' in resources or '*' in resources) and ('get' in verbs or 'list' in verbs or '*' in verbs):\n            if not name.startswith('system:'):\n                print(f'ClusterRole: {name} -> can access secrets (verbs: {verbs})')\n\"\n\n# Find roles with pod\u002Fexec permissions (container escape risk)\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        if 'pods\u002Fexec' in resources or 'pods\u002F*' in resources:\n            print(f'ClusterRole: {name} -> has pods\u002Fexec access')\n\"\n```\n\n### Step 2: Audit ClusterRoleBindings and RoleBindings\n\nReview bindings to identify who has elevated access and detect overly broad group assignments.\n\n```bash\n# List all ClusterRoleBindings with the subjects\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    name = binding['metadata']['name']\n    role = binding['roleRef']['name']\n    subjects = binding.get('subjects', [])\n    for subject in subjects:\n        kind = subject.get('kind', '')\n        subj_name = subject.get('name', '')\n        ns = subject.get('namespace', 'cluster-wide')\n        print(f'{name} -> Role: {role} | {kind}: {subj_name} ({ns})')\n\" | sort\n\n# Find bindings to cluster-admin\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    if binding['roleRef']['name'] == 'cluster-admin':\n        print(f\\\"Binding: {binding['metadata']['name']}\\\")\n        for subject in binding.get('subjects', []):\n            print(f\\\"  {subject.get('kind')}: {subject.get('name')} (ns: {subject.get('namespace', 'N\u002FA')})\\\")\n\"\n\n# Find bindings granting access to all authenticated users\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    for subject in binding.get('subjects', []):\n        if subject.get('name') in ['system:authenticated', 'system:unauthenticated']:\n            print(f\\\"WARNING: {binding['metadata']['name']} grants {binding['roleRef']['name']} to {subject['name']}\\\")\n\"\n```\n\n### Step 3: Scan with rbac-tool for Comprehensive Analysis\n\nUse rbac-tool for automated RBAC analysis including who-can queries and policy generation.\n\n```bash\n# Who can get secrets across all namespaces\nkubectl rbac-tool who-can get secrets\n\n# Who can create pods (potential for container escape)\nkubectl rbac-tool who-can create pods\n\n# Who can exec into pods\nkubectl rbac-tool who-can create pods\u002Fexec\n\n# Who can escalate privileges (bind\u002Fescalate verbs)\nkubectl rbac-tool who-can bind clusterroles\nkubectl rbac-tool who-can escalate clusterroles\n\n# Generate RBAC policy report\nkubectl rbac-tool analysis\n\n# Visualize RBAC relationships\nkubectl rbac-tool viz --outformat dot > rbac-graph.dot\ndot -Tpng rbac-graph.dot -o rbac-graph.png\n```\n\n### Step 4: Run KubiScan for Risky Permissions Detection\n\nUse KubiScan to automatically identify risky service accounts, pods, and RBAC configurations.\n\n```bash\n# Run KubiScan to find risky roles\npython3 -m kubiscan -rroles   # List risky Roles\npython3 -m kubiscan -rcr      # List risky ClusterRoles\npython3 -m kubiscan -rrb      # List risky RoleBindings\npython3 -m kubiscan -rcrb     # List risky ClusterRoleBindings\n\n# Find risky service accounts\npython3 -m kubiscan -rs       # Risky service accounts\n\n# Find pods running with risky service accounts\npython3 -m kubiscan -rp       # Risky pods\n\n# Check for privilege escalation paths\npython3 -m kubiscan -pe       # Privilege escalation vectors\n\n# Generate full report\npython3 -m kubiscan -a        # All checks\n```\n\n### Step 5: Audit Service Account Token Mounting and Usage\n\nCheck for unnecessary service account token mounts that could enable lateral movement from compromised pods.\n\n```bash\n# Find pods with automounted service account tokens\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    sa = pod['spec'].get('serviceAccountName', 'default')\n    automount = pod['spec'].get('automountServiceAccountToken', True)\n    if automount and sa != 'default':\n        print(f'{ns}\u002F{name} -> SA: {sa} (token auto-mounted)')\n\"\n\n# Find service accounts with non-default token secrets\nkubectl get serviceaccounts --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor sa in data['items']:\n    name = sa['metadata']['name']\n    ns = sa['metadata']['namespace']\n    secrets = sa.get('secrets', [])\n    if name != 'default' and len(secrets) > 0:\n        print(f'{ns}\u002F{name}: {len(secrets)} secret(s) bound')\n\"\n\n# Check for pods running as privileged or with host access\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    for container in pod['spec'].get('containers', []):\n        sc = container.get('securityContext', {})\n        if sc.get('privileged', False) or sc.get('runAsUser', 1) == 0:\n            print(f'RISK: {ns}\u002F{name}\u002F{container[\\\"name\\\"]} - privileged={sc.get(\\\"privileged\\\",False)} runAsRoot={sc.get(\\\"runAsUser\\\",\\\"not set\\\")==0}')\n\"\n```\n\n### Step 6: Run Kubeaudit for RBAC and Security Policy Validation\n\nExecute Kubeaudit for comprehensive security checks including RBAC-related findings.\n\n```bash\n# Run all kubeaudit checks\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig\n\n# Run specific RBAC-related checks\nkubeaudit privesc    # Check for allowPrivilegeEscalation\nkubeaudit rootfs     # Check for readOnlyRootFilesystem\nkubeaudit nonroot    # Check for runAsNonRoot\nkubeaudit capabilities  # Check for dangerous capabilities\n\n# Output as JSON for processing\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig -f json > kubeaudit-results.json\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| RBAC | Role-Based Access Control in Kubernetes, a method for regulating access to cluster resources based on the roles of individual users or service accounts |\n| ClusterRole | Cluster-wide role definition that specifies permissions (verbs on resources) applicable across all namespaces |\n| ClusterRoleBinding | Associates a ClusterRole with subjects (users, groups, service accounts) at the cluster scope |\n| Service Account | Identity associated with pods for authenticating to the Kubernetes API server, automatically mounted unless disabled |\n| automountServiceAccountToken | Pod spec field controlling whether the service account token is automatically mounted into the pod filesystem |\n| Privilege Escalation | RBAC verbs (bind, escalate, impersonate) that allow a user to grant themselves or others elevated permissions |\n\n## Tools & Systems\n\n- **kubectl**: Primary CLI for querying Kubernetes RBAC resources (roles, bindings, service accounts)\n- **rbac-tool**: kubectl plugin for RBAC analysis including who-can queries, visualization, and policy generation\n- **KubiScan**: Python tool for scanning Kubernetes RBAC for risky permissions and privilege escalation paths\n- **Kubeaudit**: Security auditing tool that checks pods and workloads for security anti-patterns including RBAC issues\n- **rakkess**: kubectl plugin showing access matrix for the current user across all resource types\n\n## Common Scenarios\n\n### Scenario: Auditing an EKS Cluster Shared by Multiple Development Teams\n\n**Context**: A shared EKS cluster serves four development teams. RBAC was configured during initial setup but has not been reviewed in 12 months. Teams report being able to access other teams' namespaces.\n\n**Approach**:\n1. List all ClusterRoleBindings to identify bindings granting broad access to authenticated users\n2. Run `kubectl rbac-tool who-can get secrets` to find subjects that can read secrets across namespaces\n3. Discover that a ClusterRoleBinding grants `edit` to `system:authenticated`, giving all users write access cluster-wide\n4. Run KubiScan to identify service accounts with risky permissions and pods running with elevated service accounts\n5. Replace the ClusterRoleBinding with namespace-scoped RoleBindings for each team\n6. Disable automountServiceAccountToken for workloads that do not need API access\n7. Create a NetworkPolicy to isolate namespace traffic between teams\n\n**Pitfalls**: Removing ClusterRoleBindings can break CI\u002FCD pipelines and operators that rely on cluster-wide access. Always audit which workloads use the bindings before removing them. EKS maps IAM roles to Kubernetes groups via aws-auth ConfigMap, so RBAC changes must be coordinated with IAM role mappings.\n\n## Output Format\n\n```\nKubernetes RBAC Audit Report\n===============================\nCluster: production-eks (EKS 1.28)\nAudit Date: 2026-02-23\nNamespaces: 12\n\nRBAC INVENTORY:\n  ClusterRoles: 48 (18 custom, 30 system)\n  ClusterRoleBindings: 32 (12 custom, 20 system)\n  Roles (namespaced): 24\n  RoleBindings (namespaced): 36\n  Service Accounts: 67\n\nCRITICAL FINDINGS:\n[RBAC-001] ClusterRoleBinding Grants edit to system:authenticated\n  Binding: authenticated-edit\n  Effect: ALL authenticated users have edit access across ALL namespaces\n  Risk: Any user can modify resources in any namespace\n  Remediation: Replace with namespace-scoped RoleBindings per team\n\n[RBAC-002] Custom ClusterRole with Wildcard Permissions\n  ClusterRole: developer-admin\n  Rules: verbs=[\"*\"], resources=[\"*\"], apiGroups=[\"*\"]\n  Bindings: 4 users via developer-admin-binding\n  Risk: Equivalent to cluster-admin without the name\n  Remediation: Scope to specific resources and verbs needed\n\nSUMMARY:\n  Principals with cluster-admin: 6 (recommended: \u003C= 3)\n  Roles with wildcard permissions: 4\n  Service accounts with secret access: 12\n  Pods with auto-mounted tokens: 45 \u002F 67\n  Privileged containers: 8\n```\n","# Auditing Kubernetes Cluster RBAC\n\n## When to Use\n\n- When performing security assessments of Kubernetes clusters (EKS, GKE, AKS, or self-managed)\n- When validating that RBAC policies enforce least privilege for users and service accounts\n- When investigating potential lateral movement or privilege escalation within a Kubernetes cluster\n- When compliance audits require documentation of access controls and permissions\n- When onboarding new teams to a shared cluster and defining appropriate RBAC policies\n\n**Do not use** for network policy auditing (use Cilium or Calico network policy tools), for container image scanning (use Trivy or Grype), or for runtime security monitoring (use Falco or Sysdig Secure).\n\n## Prerequisites\n\n- kubectl configured with cluster-admin or equivalent read permissions to the target cluster\n- rbac-tool installed (`kubectl krew install rbac-tool` or binary from GitHub)\n- KubiScan installed (`pip install kubiscan`)\n- Kubeaudit installed (`brew install kubeaudit` or from GitHub releases)\n- Access to the cluster's audit logs for correlating RBAC findings with actual API access\n\n## Workflow\n\n### Step 1: Enumerate ClusterRoles and Roles with Dangerous Permissions\n\nIdentify roles with wildcard permissions, secret access, pod exec, or escalation capabilities.\n\n```bash\n# List all ClusterRoles with wildcard verb access\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        verbs = rule.get('verbs', [])\n        resources = rule.get('resources', [])\n        if '*' in verbs or '*' in resources:\n            print(f'ClusterRole: {name}')\n            print(f'  Verbs: {verbs}')\n            print(f'  Resources: {resources}')\n            print(f'  API Groups: {rule.get(\\\"apiGroups\\\", [])}')\n            print()\n\"\n\n# Find roles that can read secrets\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        verbs = rule.get('verbs', [])\n        if ('secrets' in resources or '*' in resources) and ('get' in verbs or 'list' in verbs or '*' in verbs):\n            if not name.startswith('system:'):\n                print(f'ClusterRole: {name} -> can access secrets (verbs: {verbs})')\n\"\n\n# Find roles with pod\u002Fexec permissions (container escape risk)\nkubectl get clusterroles -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor role in data['items']:\n    name = role['metadata']['name']\n    for rule in role.get('rules', []):\n        resources = rule.get('resources', [])\n        if 'pods\u002Fexec' in resources or 'pods\u002F*' in resources:\n            print(f'ClusterRole: {name} -> has pods\u002Fexec access')\n\"\n```\n\n### Step 2: Audit ClusterRoleBindings and RoleBindings\n\nReview bindings to identify who has elevated access and detect overly broad group assignments.\n\n```bash\n# List all ClusterRoleBindings with the subjects\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    name = binding['metadata']['name']\n    role = binding['roleRef']['name']\n    subjects = binding.get('subjects', [])\n    for subject in subjects:\n        kind = subject.get('kind', '')\n        subj_name = subject.get('name', '')\n        ns = subject.get('namespace', 'cluster-wide')\n        print(f'{name} -> Role: {role} | {kind}: {subj_name} ({ns})')\n\" | sort\n\n# Find bindings to cluster-admin\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    if binding['roleRef']['name'] == 'cluster-admin':\n        print(f\\\"Binding: {binding['metadata']['name']}\\\")\n        for subject in binding.get('subjects', []):\n            print(f\\\"  {subject.get('kind')}: {subject.get('name')} (ns: {subject.get('namespace', 'N\u002FA')})\\\")\n\"\n\n# Find bindings granting access to all authenticated users\nkubectl get clusterrolebindings -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor binding in data['items']:\n    for subject in binding.get('subjects', []):\n        if subject.get('name') in ['system:authenticated', 'system:unauthenticated']:\n            print(f\\\"WARNING: {binding['metadata']['name']} grants {binding['roleRef']['name']} to {subject['name']}\\\")\n\"\n```\n\n### Step 3: Scan with rbac-tool for Comprehensive Analysis\n\nUse rbac-tool for automated RBAC analysis including who-can queries and policy generation.\n\n```bash\n# Who can get secrets across all namespaces\nkubectl rbac-tool who-can get secrets\n\n# Who can create pods (potential for container escape)\nkubectl rbac-tool who-can create pods\n\n# Who can exec into pods\nkubectl rbac-tool who-can create pods\u002Fexec\n\n# Who can escalate privileges (bind\u002Fescalate verbs)\nkubectl rbac-tool who-can bind clusterroles\nkubectl rbac-tool who-can escalate clusterroles\n\n# Generate RBAC policy report\nkubectl rbac-tool analysis\n\n# Visualize RBAC relationships\nkubectl rbac-tool viz --outformat dot > rbac-graph.dot\ndot -Tpng rbac-graph.dot -o rbac-graph.png\n```\n\n### Step 4: Run KubiScan for Risky Permissions Detection\n\nUse KubiScan to automatically identify risky service accounts, pods, and RBAC configurations.\n\n```bash\n# Run KubiScan to find risky roles\npython3 -m kubiscan -rroles   # List risky Roles\npython3 -m kubiscan -rcr      # List risky ClusterRoles\npython3 -m kubiscan -rrb      # List risky RoleBindings\npython3 -m kubiscan -rcrb     # List risky ClusterRoleBindings\n\n# Find risky service accounts\npython3 -m kubiscan -rs       # Risky service accounts\n\n# Find pods running with risky service accounts\npython3 -m kubiscan -rp       # Risky pods\n\n# Check for privilege escalation paths\npython3 -m kubiscan -pe       # Privilege escalation vectors\n\n# Generate full report\npython3 -m kubiscan -a        # All checks\n```\n\n### Step 5: Audit Service Account Token Mounting and Usage\n\nCheck for unnecessary service account token mounts that could enable lateral movement from compromised pods.\n\n```bash\n# Find pods with automounted service account tokens\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    sa = pod['spec'].get('serviceAccountName', 'default')\n    automount = pod['spec'].get('automountServiceAccountToken', True)\n    if automount and sa != 'default':\n        print(f'{ns}\u002F{name} -> SA: {sa} (token auto-mounted)')\n\"\n\n# Find service accounts with non-default token secrets\nkubectl get serviceaccounts --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor sa in data['items']:\n    name = sa['metadata']['name']\n    ns = sa['metadata']['namespace']\n    secrets = sa.get('secrets', [])\n    if name != 'default' and len(secrets) > 0:\n        print(f'{ns}\u002F{name}: {len(secrets)} secret(s) bound')\n\"\n\n# Check for pods running as privileged or with host access\nkubectl get pods --all-namespaces -o json | python3 -c \"\nimport json, sys\ndata = json.load(sys.stdin)\nfor pod in data['items']:\n    name = pod['metadata']['name']\n    ns = pod['metadata']['namespace']\n    for container in pod['spec'].get('containers', []):\n        sc = container.get('securityContext', {})\n        if sc.get('privileged', False) or sc.get('runAsUser', 1) == 0:\n            print(f'RISK: {ns}\u002F{name}\u002F{container[\\\"name\\\"]} - privileged={sc.get(\\\"privileged\\\",False)} runAsRoot={sc.get(\\\"runAsUser\\\",\\\"not set\\\")==0}')\n\"\n```\n\n### Step 6: Run Kubeaudit for RBAC and Security Policy Validation\n\nExecute Kubeaudit for comprehensive security checks including RBAC-related findings.\n\n```bash\n# Run all kubeaudit checks\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig\n\n# Run specific RBAC-related checks\nkubeaudit privesc    # Check for allowPrivilegeEscalation\nkubeaudit rootfs     # Check for readOnlyRootFilesystem\nkubeaudit nonroot    # Check for runAsNonRoot\nkubeaudit capabilities  # Check for dangerous capabilities\n\n# Output as JSON for processing\nkubeaudit all --kubeconfig ~\u002F.kube\u002Fconfig -f json > kubeaudit-results.json\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| RBAC | Role-Based Access Control in Kubernetes, a method for regulating access to cluster resources based on the roles of individual users or service accounts |\n| ClusterRole | Cluster-wide role definition that specifies permissions (verbs on resources) applicable across all namespaces |\n| ClusterRoleBinding | Associates a ClusterRole with subjects (users, groups, service accounts) at the cluster scope |\n| Service Account | Identity associated with pods for authenticating to the Kubernetes API server, automatically mounted unless disabled |\n| automountServiceAccountToken | Pod spec field controlling whether the service account token is automatically mounted into the pod filesystem |\n| Privilege Escalation | RBAC verbs (bind, escalate, impersonate) that allow a user to grant themselves or others elevated permissions |\n\n## Tools & Systems\n\n- **kubectl**: Primary CLI for querying Kubernetes RBAC resources (roles, bindings, service accounts)\n- **rbac-tool**: kubectl plugin for RBAC analysis including who-can queries, visualization, and policy generation\n- **KubiScan**: Python tool for scanning Kubernetes RBAC for risky permissions and privilege escalation paths\n- **Kubeaudit**: Security auditing tool that checks pods and workloads for security anti-patterns including RBAC issues\n- **rakkess**: kubectl plugin showing access matrix for the current user across all resource types\n\n## Common Scenarios\n\n### Scenario: Auditing an EKS Cluster Shared by Multiple Development Teams\n\n**Context**: A shared EKS cluster serves four development teams. RBAC was configured during initial setup but has not been reviewed in 12 months. Teams report being able to access other teams' namespaces.\n\n**Approach**:\n1. List all ClusterRoleBindings to identify bindings granting broad access to authenticated users\n2. Run `kubectl rbac-tool who-can get secrets` to find subjects that can read secrets across namespaces\n3. Discover that a ClusterRoleBinding grants `edit` to `system:authenticated`, giving all users write access cluster-wide\n4. Run KubiScan to identify service accounts with risky permissions and pods running with elevated service accounts\n5. Replace the ClusterRoleBinding with namespace-scoped RoleBindings for each team\n6. Disable automountServiceAccountToken for workloads that do not need API access\n7. Create a NetworkPolicy to isolate namespace traffic between teams\n\n**Pitfalls**: Removing ClusterRoleBindings can break CI\u002FCD pipelines and operators that rely on cluster-wide access. Always audit which workloads use the bindings before removing them. EKS maps IAM roles to Kubernetes groups via aws-auth ConfigMap, so RBAC changes must be coordinated with IAM role mappings.\n\n## Output Format\n\n```\nKubernetes RBAC Audit Report\n===============================\nCluster: production-eks (EKS 1.28)\nAudit Date: 2026-02-23\nNamespaces: 12\n\nRBAC INVENTORY:\n  ClusterRoles: 48 (18 custom, 30 system)\n  ClusterRoleBindings: 32 (12 custom, 20 system)\n  Roles (namespaced): 24\n  RoleBindings (namespaced): 36\n  Service Accounts: 67\n\nCRITICAL FINDINGS:\n[RBAC-001] ClusterRoleBinding Grants edit to system:authenticated\n  Binding: authenticated-edit\n  Effect: ALL authenticated users have edit access across ALL namespaces\n  Risk: Any user can modify resources in any namespace\n  Remediation: Replace with namespace-scoped RoleBindings per team\n\n[RBAC-002] Custom ClusterRole with Wildcard Permissions\n  ClusterRole: developer-admin\n  Rules: verbs=[\"*\"], resources=[\"*\"], apiGroups=[\"*\"]\n  Bindings: 4 users via developer-admin-binding\n  Risk: Equivalent to cluster-admin without the name\n  Remediation: Scope to specific resources and verbs needed\n\nSUMMARY:\n  Principals with cluster-admin: 6 (recommended: \u003C= 3)\n  Roles with wildcard permissions: 4\n  Service accounts with secret access: 12\n  Pods with auto-mounted tokens: 45 \u002F 67\n  Privileged containers: 8\n```\n",{"name":5,"tags":49,"author":51,"domain":42,"license":15,"version":52,"category":5,"nist_csf":53,"subdomain":40,"description":58,"mitre_attack":59},[40,27,24,50,39,38,37],"access-control","mahipal","1.0",[54,55,56,57],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.\n",[60,61,62,63,64],"T1098.006","T1552.007","T1611","T1613","T1078.004","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fauditing-kubernetes-cluster-rbac",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill auditing-kubernetes-cluster-rbac",{"tool":79,"command":80},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill auditing-kubernetes-cluster-rbac",{"tool":82,"command":83},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill auditing-kubernetes-cluster-rbac","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fauditing-kubernetes-cluster-rbac\u002FSKILL.md",true,[87,92,98],{"path":88,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fauditing-kubernetes-cluster-rbac\u002FLICENSE",{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fapi-reference.md","REFERENCE","参考文档",2193,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fauditing-kubernetes-cluster-rbac\u002Freferences\u002Fapi-reference.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",7019,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fauditing-kubernetes-cluster-rbac\u002Fscripts\u002Fagent.py",[105,133,159,181,197,216],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":114,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[111],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[115,116,117,118,119,120,42,121,122,123,124,125,126,36,127,128,129,130,131,132],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[140,141,142,143,144,42,145,146,147,148,149,150,151,152,153,154,155,156,157,158],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","with","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[43,166,130,42,167,168,169,36,127,170,171,172,173,174,175,176,177,178,179,180],"triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[43,188,189,166,130,144,42,190,168,124,191,192,36,127,193,171,154,194,195,196],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[43,204,205,206,207,208,42,209,210,211,168,212,36,213,214,215,174,33,130,32],"security alerts","splunk","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","t1566","notable-events","incident-review",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":222,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[223,224,225,226,42,227,228,229,230,231,232,213,233,234,33,235,32,236,237,238],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]