Kubernetes Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRole are not mi

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_158
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize

Impact

Role or ClusterRoles that grant permissions to escalate Roles or ClusterRoles should be minimized to reduce powerful identities in the cluster. Such Roles and ClusterRoles can add arbitrary permissions to arbitrary identities. Escalating Roles can add permissions over a namespace, while escalating ClusterRoles can add permissions over the entire cluster. Minimize such Roles and ClusterRoles to limit the number of powerful credentials that if compromised could escalate privileges and possibly take over the entire cluster.

How to Fix

Kind: ClusterRole, Role

• Arguments: rules ClusterRoles and Roles that grant the "escalate" verbs over "clusterroles" or "roles" in the "rbac.authorization.k8s.io" API group should be minimized. [source,go]

---

kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: rules:

• apiGroups: ["rbac.authorization.k8s.io"] resources: ["roles", "clusterrolebindings"] verbs: ["get", "list", "create", "update"] x- apiGroups: ["rbac.authorization.k8s.io"] x resources: ["clusterroles"] x verbs: ["escalate"]

---