RBAC monitoring

Exercice: find RBAC security issue

Connect to Kubernetes:

kubectx kind-kind

Somewhere in this cluster, a ServiceAccount has been granted far more power than it needs. Find it.

Three tools are already installed on the training server:

Tool	Try
rakkess	`rakkess` — or `kubectl access-matrix resource pods --verbs get` to see it per ServiceAccount
kubescape	`kubescape scan`, then drill into the administrative roles it counts: `kubescape scan control C-0035 -v`
rbac-tool	`rbac-tool who-can delete secrets`

Tip

rbac-tool is not preinstalled: get it with ~/k8s-advanced/labs/2_authorization/A_rbac_tools_demo.sh, which downloads it into ~/k8s-advanced/bin.

Once you have found it, answer: which ClusterRole is bound, to which ServiceAccount, and what could an attacker do with a pod running under it?