New policy: Disallow verbs in (Cluster)Roles

[viccuad]

Description

This policy disallows the usage of the bind, impersonate, escalate verbs in Roles and ClusterRoles.

These verbs can be used to escalate privileges (escalate), bypass RBAC by creating bindings to roles with rights one doesn't have (bind), or gain the rights of other users (impersonate).

Implements good practices from https://kubernetes.io/docs/concepts/security/rbac-good-practices/.

Configuration

None

Examples

This Role would get rejected:

apiVersion: rbac.authorization.k8s.io.v1beta1
kind: Role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["impersonate", "get", "watch", "list"]

While this ClusterRole would get accepted:

apiVersion: rbac.authorization.k8s.io.v1beta1
kind: Role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]