git:20260521.2bcbdef to git:20260521.1efe3e0

---

name: review-security-k8s-rbac

description: Reviews Kubernetes RBAC configurations for permissions and privilege escalation risks.

---

# Task

Review Kubernetes RBAC configurations for vulnerabilities, prioritizing GKE best practices and advanced attack vectors.

# Checks

## 1. Global & Default Configs

- **Default Groups/Users**: Flag non-default bindings for `system:anonymous`, `system:unauthenticated`, `system:authenticated`, `system:masters`.

- **Broad Service Accounts**: Flag bindings for `system:serviceaccounts` or `system:serviceaccounts:<namespace>`.

- **Cluster Admin**: Flag `cluster-admin` bindings to unauthenticated/broad groups.

- **System Roles**: Flag `delete`/`update` on `system:` prefixed bindings.

- **Missing Namespaces**: Flag `ClusterRoleBindings` to `ServiceAccount` missing a `namespace`.

## 2. Privilege Escalation & Bypasses

- **RBAC & CSR**: Flag `bind`, `escalate`, `create`, `update`, `patch` on `rbac.authorization.k8s.io`. Flag `create` on `certificatesigningrequests` or `update` on `certificatesigningrequests/approval`.

- **Webhooks & CRDs**: Flag `create`, `update`, `patch` on `mutatingwebhookconfigurations`, `validatingwebhookconfigurations`, or `customresourcedefinitions`.

- **Auth Probing**: Flag `create` on `tokenreviews`/`subjectaccessreviews`.

- **Policy Bypass**: Flag `update`/`patch` on `namespaces` (PSA bypass) or modification access to `networkpolicies`.

## 3. Role & Binding Design

- **Wildcards**: Flag `*` in `apiGroups`, `resources`, `verbs`. Flag `deletecollection` (DoS risk).

- **Escalation Verbs**: Flag `escalate`, `bind`, `impersonate`.

- **Over-scoped**: Flag `ClusterRoleBindings` used where namespace-local `RoleBindings` suffice. Flag disjoint resource/verb sets in single roles.

- **Self-Modification**: Flag roles allowing pods to self-modify (e.g., updating own ServiceAccount/rolebindings).

## 4. Sensitive Resources

- **Highly Sensitive**: Flag access to `secrets`, `pods/exec`, `pods/portforward`, `pods/attach`, `nodes/proxy` (unless strictly scoped via `resourceNames`).

- **Secret Harvesting**: Flag `list` or `watch` on `secrets`.

- **Ephemeral/Status**: Flag `update`/`patch` on `pods/ephemeralcontainers` or `/status` subresources.