<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Auditing Kubernetes RBAC in Cloud — API Reference

## kubectl Commands

### RBAC Inspection

```bash
# List ClusterRoleBindings
kubectl get clusterrolebindings -o wide

# Describe a ClusterRoleBinding
kubectl describe clusterrolebinding BINDING_NAME

# List ClusterRoles
kubectl get clusterroles -o wide

# View ClusterRole permissions
kubectl describe clusterrole ROLE_NAME

# List RoleBindings in namespace
kubectl get rolebindings -n NAMESPACE -o wide
```

### Service Account Inspection

```bash
# List service accounts
kubectl get serviceaccounts --all-namespaces

# Check service account annotations (IRSA/Workload Identity)
kubectl get sa SA_NAME -n NAMESPACE -o yaml

# Check automountServiceAccountToken
kubectl get sa --all-namespaces -o json | jq '.items[] | select(.automountServiceAccountToken != false)'
```

### Namespace Security

```bash
# List NetworkPolicies
kubectl get networkpolicies --all-namespaces

# List ResourceQuotas
kubectl get resourcequotas --all-namespaces

# List Pod Security Admission labels
kubectl get namespaces -o json | jq '.items[] | {name: .metadata.name, labels: .metadata.labels}'
```

## Cloud-Specific Commands

### EKS

```bash
# Get kubeconfig
aws eks update-kubeconfig --name CLUSTER --region REGION

# View aws-auth ConfigMap
kubectl get configmap aws-auth -n kube-system -o yaml

# List IRSA service accounts
kubectl get sa --all-namespaces -o json | jq '.items[] | select(.metadata.annotations["eks.amazonaws.com/role-arn"])'
```

### AKS

```bash
# Get credentials
az aks get-credentials --name CLUSTER --resource-group RG

# Check AAD integration
az aks show --name CLUSTER --resource-group RG --query "aadProfile"
```

### GKE

```bash
# Get credentials
gcloud container clusters get-credentials CLUSTER --zone ZONE

# Check Workload Identity
gcloud container clusters describe CLUSTER --zone ZONE --format="value(workloadIdentityConfig)"
```

## CIS Kubernetes Benchmark Controls

| Control | Description |
|---------|-------------|
| 5.1.1 | Ensure cluster-admin role is only used where required |
| 5.1.2 | Minimize access to secrets |
| 5.1.3 | Minimize wildcard use in Roles and ClusterRoles |
| 5.1.5 | Ensure default service accounts are not actively used |
| 5.1.6 | Ensure automountServiceAccountToken is false |
| 5.3.2 | Ensure NetworkPolicy is defined for each namespace |
