Ensure Cluster-Admin Role Is Only Used Where Required (CIS 5.1.1)

​

Impact & Risk Analysis

• Severity: Critical
• CIS Benchmark: CIS 5.1.1
• Impact: Full Cluster Compromise. The cluster-admin role grants super-user access to perform any action on any resource in the cluster. If a user or service account with this role is compromised, the attacker has complete control over the entire Kubernetes environment, including all secrets, nodes, and workloads.

​

Common Misconfiguration

​

Vulnerable Example

# Vulnerable ClusterRoleBinding
# Grants the "cluster-admin" super-user role to a regular developer
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dev-is-admin
subjects:
- kind: User
  name: john.doe@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  # VULNERABLE: Grants infinite power
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

​

Secure Example

# Secure ClusterRoleBinding
# Grants a limited "view" role instead of admin
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dev-is-viewer
subjects:
- kind: User
  name: john.doe@example.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  # SECURE: Only allows reading resources, not modifying them
  name: view
  apiGroup: rbac.authorization.k8s.io

​

Audit Procedure

kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name

• Result: Look for any binding where the ROLE column is cluster-admin.
• Analyze: Review the SUBJECT column.
• Pass: If the subjects are only system:masters or critical system components (often starting with system:).
• Fail: If the list includes individual users, developers, or generic service accounts that do not require full control.

​

Remediation

1. Check if the user/service account actually needs full control.
2. If not, create a custom Role/ClusterRole with fewer privileges or use a default role like view or edit.
3. Remove the excessive binding:

kubectl delete clusterrolebinding [name]