RBAC monitoring

Exercice: find RBAC security issue

Connect to Kubernetes:

# The shared kind cluster, prepared by the trainer
kubectx kind-kind

Somewhere in this cluster, a ServiceAccount has been granted far more power than it needs. Find it.

Three tools are already installed on the training server:

Tool	Try
rakkess	`rakkess` — or `kubectl access-matrix resource pods --verbs get` to see it per ServiceAccount
kubescape	`kubescape scan`, then drill into the administrative roles it counts: `kubescape scan control C-0035 -v`
rbac-tool	`rbac-tool who-can delete secrets`

Tip

rbac-tool is not preinstalled: get it with curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash, which downloads it into ./bin.

Once you have found it, answer: which ClusterRole is bound, to which ServiceAccount, and what could an attacker do with a pod running under it?