rbac

Overview ¶

Package rbac analyzes Role/ClusterRole bindings and flags subjects whose effective permissions enable privilege escalation or data exfiltration.

Content for RBAC findings. Each rule has a builder that takes runtime context (namespace, subject, source role/binding) and returns an enriched ruleContent with scope-aware language, an attacker walkthrough, ordered remediation steps, and structured references / MITRE technique citations.

Sources for the content below: Kubernetes RBAC Good Practices, NSA/CISA Kubernetes Hardening Guide v1.2, MITRE ATT&CK Containers matrix, Microsoft Threat Matrix for Kubernetes, kubernetes/kubernetes#119640 (nodes/proxy escalation), Datadog Security Labs (TokenRequest persistence), Aqua Security and SCHUTZWERK RBAC writeups.