review-security-k8s-rbac git:20260521.1efe3e0A

Immutable. This exact content is served forever at /api/v1/blob/b9b23331771a6df2.

---
name: review-security-k8s-rbac
description: Reviews Kubernetes RBAC configurations for permissions and privilege escalation risks.
---
# Task
Review Kubernetes RBAC configurations for vulnerabilities, prioritizing GKE best practices and advanced attack vectors.

# Checks
## 1. Global & Default Configs
- **Default Groups/Users**: Flag non-default bindings for `system:anonymous`, `system:unauthenticated`, `system:authenticated`, `system:masters`.
- **Broad Service Accounts**: Flag bindings for `system:serviceaccounts` or `system:serviceaccounts:<namespace>`.
- **Cluster Admin**: Flag `cluster-admin` bindings to unauthenticated/broad groups.
- **System Roles**: Flag `delete`/`update` on `system:` prefixed bindings.
- **Missing Namespaces**: Flag `ClusterRoleBindings` to `ServiceAccount` missing a `namespace`.

## 2. Privilege Escalation & Bypasses
- **RBAC & CSR**: Flag `bind`, `escalate`, `create`, `update`, `patch` on `rbac.authorization.k8s.io`. Flag `create` on `certificatesigningrequests` or `update` on `certificatesigningrequests/approval`.
- **Webhooks & CRDs**: Flag `create`, `update`, `patch` on `mutatingwebhookconfigurations`, `validatingwebhookconfigurations`, or `customresourcedefinitions`.
- **Auth Probing**: Flag `create` on `tokenreviews`/`subjectaccessreviews`.
- **Policy Bypass**: Flag `update`/`patch` on `namespaces` (PSA bypass) or modification access to `networkpolicies`.

## 3. Role & Binding Design
- **Wildcards**: Flag `*` in `apiGroups`, `resources`, `verbs`. Flag `deletecollection` (DoS risk).
- **Escalation Verbs**: Flag `escalate`, `bind`, `impersonate`.
- **Over-scoped**: Flag `ClusterRoleBindings` used where namespace-local `RoleBindings` suffice. Flag disjoint resource/verb sets in single roles.
- **Self-Modification**: Flag roles allowing pods to self-modify (e.g., updating own ServiceAccount/rolebindings).

## 4. Sensitive Resources
- **Highly Sensitive**: Flag access to `secrets`, `pods/exec`, `pods/portforward`, `pods/attach`, `nodes/proxy` (unless strictly scoped via `resourceNames`).
- **Secret Harvesting**: Flag `list` or `watch` on `secrets`.
- **Ephemeral/Status**: Flag `update`/`patch` on `pods/ephemeralcontainers` or `/status` subresources.

## 5. GKE RBAC Guide
- Refer to `resources/gke-rbac.md` for additional guidance. Identify if any of this guidance is both relevant and missing from your review and include those findings as well.