implementing-rbac-hardening-for-kubernetes

Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.

跳到安装

仓库: xalgord/xalgorix
最近来源活动: 2026年6月6日 16:41
检测到的 SKILL.md 语言: 英语
星标: 813
分支: 146

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/xalgord/xalgorix --skill implementing-rbac-hardening-for-kubernetes

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

查看这个仓库的全部 Skills

Implementing RBAC Hardening for Kubernetes

Overview

Kubernetes RBAC regulates access to cluster resources based on roles assigned to users, groups, and service accounts. Default configurations often grant excessive permissions, and without active hardening, RBAC becomes a primary attack vector for privilege escalation, lateral movement, and data exfiltration. Hardening requires implementing least-privilege principles, eliminating unnecessary ClusterRole bindings, separating service accounts, integrating external identity providers, and continuous auditing.

When to Use

When deploying or configuring implementing rbac hardening for kubernetes capabilities in your environment

When establishing security controls aligned to compliance requirements

When building or improving security architecture for this domain

When conducting security assessments that require this implementation

Common Misconfigurations & Verification

These are the RBAC grants that look harmless but hand over the cluster. Grep every Role/ClusterRole before signing off:

Wildcard verbs/resources: verbs: ["*"] or resources: ["*"] on any apiGroup is effectively admin. Find them:

kubectl get clusterroles,roles -A -o json | jq '.items[]|select(.rules[]?|(.verbs[]?=="*") or (.resources[]?=="*"))|.metadata.name'

Escalation verbs: escalate and bind on roles/clusterroles let a subject grant themselves any permission - a namespace escalate is equivalent to cluster-admin. impersonate on users/groups/serviceaccounts bypasses their own RBAC entirely.

Token/exec paths: create on pods/exec, pods/attach, serviceaccounts/token, or secrets get/list are lateral-movement primitives even without admin.

Aggregated ClusterRoles: roles with aggregationRule silently inherit new permissions when matching-labeled roles are added.

Verify, don't assume: confirm the effective access with kubectl auth can-i <verb> <resource> --as=system:serviceaccount:<ns>:<sa> rather than reading YAML, and cross-check with rbac-lookup / access-matrix. A binding that references a non-existent role is inert; a binding to system:authenticated or system:anonymous applies to everyone. Re-run after every change - RBAC is additive and never subtracts.