Checks

Check whether role permits wildcard verb on specific resources

Full control of the cluster resources, and therefore also root on all nodes where workloads can run and has access to all pods, secrets, and data.

Check whether role permits privilege escalation from node proxy

Depending on the policies enforced by the admission controller, this permission ranges from the ability to steal compute (crypto) by running workloads or allowing for creating workloads that escape to the node as root and escalation to cluster-admin.

Some workloads leverage configmaps to store sensitive data or configuration parameters that affect runtime behavior that can be modified by an attacker or combined with another issue to potentially lead to compromise.

Check whether role permits escalate, bind, or impersonate on roles/rolebindings, which can lead to privilege escalation.

Check whether role permits creating role bindings and associating to privileged role/clusterrole

Check whether role permits creating role ClusterRoleBindings and association with privileged cluster role

The ability to exec into a container with privileged access to the host or with an attached SA with higher RBAC permissions is a common escalation path to cluster-admin.

Check whether role permits attaching to shell on pods

Check whether role permits allowing users in a rolebinding to add other users to their rolebindings

The ability to control which pods get service traffic directed to them allows for interception attacks. Controlling network policy allows for bypassing lateral movement restrictions.

Storing sensitive content such as usernames and email addresses in configMaps is unsafe

Binding to system:authenticate group to any clusterrole or role is a security risk.

Check if Helm Tiller component is deployed.

Windows pods offer the ability to run HostProcess containers which enable privileged access to the Windows node.

A program inside the container can bypass Seccomp protection policies.

Containers should be forbidden from running with a root UID.

Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

The specified 'apiVersion' and 'kind' are deprecated and are planned to be removed

Services with external IP addresses allows direct access from the internet and might expose risk for CVE-2020-8554

Storing secrets in configMaps is unsafe

Checks whether a workload is running in the default namespace.

Either cluster-admin or those granted powerful permissions.