Task

Review Kubernetes RBAC configurations for vulnerabilities, prioritizing GKE best practices and advanced attack vectors.

Checks

1. Global & Default Configs

• Default Groups/Users: Flag non-default bindings for system:anonymous, system:unauthenticated, system:authenticated, system:masters.
• Broad Service Accounts: Flag bindings for system:serviceaccounts or system:serviceaccounts:<namespace>.
• Cluster Admin: Flag cluster-admin bindings to unauthenticated/broad groups.
• System Roles: Flag delete/update on system: prefixed bindings.
• Missing Namespaces: Flag ClusterRoleBindings to ServiceAccount missing a namespace.

2. Privilege Escalation & Bypasses

• RBAC & CSR: Flag bind, escalate, create, update, patch on rbac.authorization.k8s.io. Flag create on certificatesigningrequests or update on certificatesigningrequests/approval.
• Webhooks & CRDs: Flag create, update, patch on mutatingwebhookconfigurations, validatingwebhookconfigurations, or customresourcedefinitions.
• Auth Probing: Flag create on tokenreviews/subjectaccessreviews.
• Policy Bypass: Flag update/patch on namespaces (PSA bypass) or modification access to networkpolicies.

3. Role & Binding Design

• Wildcards: Flag * in apiGroups, resources, verbs. Flag deletecollection (DoS risk).
• Escalation Verbs: Flag escalate, bind, impersonate.
• Over-scoped: Flag ClusterRoleBindings used where namespace-local RoleBindings suffice. Flag disjoint resource/verb sets in single roles.
• Self-Modification: Flag roles allowing pods to self-modify (e.g., updating own ServiceAccount/rolebindings).

4. Sensitive Resources

• Highly Sensitive: Flag access to secrets, pods/exec, pods/portforward, pods/attach, nodes/proxy (unless strictly scoped via resourceNames).
• Secret Harvesting: Flag list or watch on secrets.
• Ephemeral/Status: Flag update/patch on pods/ephemeralcontainers or /status subresources.

5. GKE RBAC Guide

• Refer to resources/gke-rbac.md for additional guidance. Identify if any of this guidance is both relevant and missing from your review and include those findings as well.