<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Kubernetes RBAC — API Reference

## kubectl Commands

### RBAC Enumeration

```bash
# List ClusterRoles
kubectl get clusterroles -o wide
kubectl get clusterroles -o json | jq '.items[].metadata.name'

# List ClusterRoleBindings
kubectl get clusterrolebindings -o wide

# List Roles (namespaced)
kubectl get roles --all-namespaces

# List RoleBindings (namespaced)
kubectl get rolebindings --all-namespaces

# Describe specific role
kubectl describe clusterrole ROLE_NAME

# Check permissions for a user/service account
kubectl auth can-i --list --as=system:serviceaccount:NAMESPACE:SA_NAME
kubectl auth can-i create pods --as=USER
```

### Service Accounts

```bash
# List all service accounts
kubectl get serviceaccounts --all-namespaces

# Check SA token automounting
kubectl get sa -n NAMESPACE SA_NAME -o jsonpath='{.automountServiceAccountToken}'

# List SA secrets
kubectl get secrets -n NAMESPACE --field-selector type=kubernetes.io/service-account-token
```

### Pod Security

```bash
# Check namespace pod security labels
kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.pod-security\.kubernetes\.io/enforce}{"\n"}{end}'

# Find privileged pods
kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.containers[].securityContext.privileged==true) | .metadata.name'

# Find pods with hostPID/hostNetwork
kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.hostPID==true or .spec.hostNetwork==true) | {ns: .metadata.namespace, name: .metadata.name}'
```

### Managed Clusters

```bash
# EKS
kubectl get configmap aws-auth -n kube-system -o yaml
aws eks describe-cluster --name CLUSTER --query 'cluster.resourcesVpcConfig'

# AKS
az aks show -g RG -n CLUSTER --query '{rbac: enableRbac, aad: aadProfile}'

# GKE
gcloud container clusters describe CLUSTER --zone ZONE --format='yaml(masterAuth, workloadIdentityConfig)'
```

## Kubernetes Python Client

### Key Methods

| Method | Description |
|--------|-------------|
| `RbacAuthorizationV1Api.list_cluster_role()` | List ClusterRoles |
| `RbacAuthorizationV1Api.list_cluster_role_binding()` | List ClusterRoleBindings |
| `RbacAuthorizationV1Api.list_namespaced_role(ns)` | List Roles in namespace |
| `RbacAuthorizationV1Api.list_namespaced_role_binding(ns)` | List RoleBindings |
| `CoreV1Api.list_service_account_for_all_namespaces()` | All SAs |
| `AuthorizationV1Api.create_self_subject_access_review()` | Permission check |

## CIS Benchmark Controls

| Control | Description |
|---------|-------------|
| 5.1.1 | Ensure cluster-admin role is only used where required |
| 5.1.2 | Minimize access to secrets |
| 5.1.3 | Minimize wildcard use in Roles and ClusterRoles |
| 5.1.5 | Ensure default service accounts are not actively used |
| 5.1.6 | Ensure Service Account Tokens are only mounted where necessary |
| 5.2.1 | Ensure privileged containers are not used |
