Cluster Admin Rolebinding With Superuser Permissions

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-access-003
  labels:
    severity: "critical" 
    category: "access"
  annotations:
    rules.spotter.dev/title: "Cluster Admin Rolebinding With Superuser Permissions"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-266"
    rules.spotter.dev/description: "The `cluster-admin` role should not be bound to regular users or groups, as it provides unrestricted superuser access to the cluster."
spec:
  match:
    resources:
      kubernetes:
        apiGroups: ["rbac.authorization.k8s.io"]
        versions: ["v1", "v1beta1"]
        kinds: ["ClusterRoleBinding"]
  cel: |
    has(object.roleRef) && object.roleRef.kind == "ClusterRole" && object.roleRef.name == "cluster-admin" &&
    has(object.subjects) && object.subjects.exists(s, s.kind in ["User", "Group", "ServiceAccount"])
  remediation:
    manual: "Avoid binding the `cluster-admin` role to users or groups. Use more specific roles and role bindings to grant only the necessary permissions."
  references:
    - title: "Using RBAC Authorization"
      url: "https://kubernetes.io/docs/reference/access-authn-authz/rbac/"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: tiller-clusterrolebinding
      namespace: kube-system
    subjects:
    - kind: ServiceAccount
      name: tiller
      namespace: kube-system
    roleRef:
      kind: ClusterRole
      name: cluster-admin
      apiGroup: ''

- name: secure sample 1 should pass
  pass: true
  input: |
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: tiller-clusterrolebinding
      namespace: kube-system
    subjects:
    - kind: ServiceAccount
      name: tiller
      namespace: kube-system
    roleRef:
      kind: ClusterRole
      name: view
      apiGroup: ''

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-access-003
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-access-003
spec:
  # Add your VAP configuration here

Rule Metadata

Cluster Admin Rolebinding With Superuser Permissions

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub