Back to Checks
kubernetes

Role or ClusterRole does not grant create permission on pods

rbac_minimize_pod_creation_access
Service: rbacSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesscluster-security
Resource Type:ClusterRole

Kubernetes RBAC Roles and ClusterRoles that grant the create verb on pods are identified.

Rules are examined to find permissions allowing pod creation at namespace or cluster scope.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Overly broad pod-creation rights allow adversaries to run malicious pods, mount service account tokens, or request privileged configs, enabling lateral movement. This endangers confidentiality (secrets), integrity (unauthorized changes), and availability (resource abuse, disruption).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks rbac_minimize_pod_creation_access

Recommendation

Apply least privilege: limit pods create to narrowly scoped service accounts and namespaces. Use separation of duties and avoid wildcards. Enforce controls with Pod Security Admission and policy engines (OPA/Kyverno) to block risky specs. Review RBAC regularly and remove unused grants.

Remediation

CLI

kubectl patch clusterrole <CLUSTERROLE_NAME> -p '{"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["get","list","watch"]}]}'

Terraform

resource "kubernetes_cluster_role_v1" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  rule {
    api_groups = [""]
    resources  = ["pods"]
    verbs      = ["get", "list", "watch"] # critical: omit "create" to prevent pod creation and pass the check
  }
}

Other

1Identify the failing RBAC object (Role or ClusterRole) that allows pods create
2For a ClusterRole: run `kubectl edit clusterrole <CLUSTERROLE_NAME>`
3For a namespaced Role: run `kubectl edit role <ROLE_NAME> -n <NAMESPACE>`
4In `rules`, find entries with `resources: ["pods"]` and remove `create` from `verbs` (keep only read verbs like get/list/watch)
5Save and exit; verify with `kubectl get` that the change applied

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.rbac.lib.role_permissions import (
    is_rule_allowing_permissions,
)
from prowler.providers.kubernetes.services.rbac.rbac_client import rbac_client

verbs = ["create"]
resources = ["pods"]


class rbac_minimize_pod_creation_access(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        # Check ClusterRoleBindings for pod create access
        for cr in rbac_client.cluster_roles.values():
            report = Check_Report_Kubernetes(
                metadata=self.metadata(), resource=cr.metadata
            )
            report.status = "PASS"
            report.status_extended = (
                f"ClusterRole {cr.metadata.name} does not have pod create access."
            )
            if is_rule_allowing_permissions(cr.rules, resources, verbs):
                report.status = "FAIL"
                report.status_extended = (
                    f"ClusterRole {cr.metadata.name} has pod create access."
                )
            findings.append(report)

        # Check RoleBindings for pod create access
        for role in rbac_client.roles.values():
            report = Check_Report_Kubernetes(
                metadata=self.metadata(), resource=role.metadata
            )
            report.status = "PASS"
            report.status_extended = (
                f"Role {role.metadata.name} does not have pod create access."
            )

            if is_rule_allowing_permissions(role.rules, resources, verbs):
                report.status = "FAIL"
                report.status_extended = (
                    f"Role {role.metadata.name} has pod create access."
                )
            findings.append(report)

        return findings

References