Minimize Access To Secrets

kubectl get roles --all-namespaces -o json | jq -r '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )
  | "\(.metadata.namespace) \(.metadata.name)"'

kubectl -n NAMESPACE get role ROLE_NAME -o yaml > ROLE_NAME-role.yaml

rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch", "create"]

rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["create"]

kubectl apply -f ROLE_NAME-role.yaml

count=$(kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l)

if [ "$count" -eq 0 ]; then
  echo "NO_SECRETS_GET_LIST_WATCH_IN_ROLES"
else
  echo "SECRETS_ACCESS_FOUND_IN_ROLES: $count"
fi

#!/usr/bin/env bash
set -euo pipefail

# Automation to minimize get/list/watch access to Secret objects in Roles.
# Runs from any machine with kubectl + jq + sed + mktemp and cluster access.

# CONFIGURABLE: set a backup directory for modified Roles
BACKUP_DIR="${BACKUP_DIR:-./role-secret-backups}"
mkdir -p "${BACKUP_DIR}"

echo "Discovering Roles that grant get/list/watch on secrets..."

# Get all Roles that reference 'secrets' with get/list/watch
role_list_json="$(kubectl get roles --all-namespaces -o json)"
mapfile -t TARGETS < <(
  echo "${role_list_json}" | jq -r '
    .items[]
    | select(
        .rules[]? as $r
        | ($r.resources[]? == "secrets")
        and (
          ($r.verbs[]? == "get") or
          ($r.verbs[]? == "list") or
          ($r.verbs[]? == "watch")
        )
      )
    | .metadata.namespace + ":" + .metadata.name
  ' | sort -u
)

if [ "${#TARGETS[@]}" -eq 0 ]; then
  echo "No Roles with get/list/watch on secrets found. Nothing to change."
else
  echo "Found ${#TARGETS[@]} Role(s) with get/list/watch on secrets."
fi

for ns_name in "${TARGETS[@]}"; do
  ns="${ns_name%%:*}"
  name="${ns_name##*:}"

  echo "Processing Role ${ns}/${name}..."

  # Backup original Role manifest (idempotent: overwrite backup each run)
  backup_file="${BACKUP_DIR}/${ns}__${name}.yaml"
  kubectl get role "${name}" -n "${ns}" -o yaml > "${backup_file}"
  echo "  Backup saved to ${backup_file}"

  # Work on a temp file
  tmpfile="$(mktemp)"
  cp "${backup_file}" "${tmpfile}"

  # Use jq to surgically remove get/list/watch verbs only for rules affecting secrets
  # Strategy:
  # - For each rule that includes "secrets" in resources, remove get/list/watch from verbs.
  # - If a rule's verbs become empty, we keep the rule (no verbs) to avoid changing indices.
  #   Kubernetes will reject a rule with no verbs, so instead we drop such rules.
  #
  # Implementation detail:
  #   1) Convert to JSON
  #   2) Transform .rules
  #   3) Convert back to yaml

  json_transformed="$(
    kubectl get role "${name}" -n "${ns}" -o json | jq '
      .rules |= map(
        if (.resources // [] | index("secrets")) != null then
          # This rule touches secrets; strip get/list/watch verbs
          .verbs |= map(select(. != "get" and . != "list" and . != "watch")) |
          # Drop rule if verbs is now empty
          if (.verbs | length) == 0 then
            empty
          else
            .
          end
        else
          .
        end
      )
    '
  )"

  # Skip apply if there is no change (idempotent)
  if diff -q <(echo "${json_transformed}" | jq -S .) <(kubectl get role "${name}" -n "${ns}" -o json | jq -S .) >/dev/null 2>&1; then
    echo "  No changes needed for ${ns}/${name}."
    rm -f "${tmpfile}"
    continue
  fi

  # Convert transformed JSON to YAML for kubectl apply
  echo "${json_transformed}" | kubectl apply -f -
  echo "  Updated Role ${ns}/${name} to remove get/list/watch on secrets."

  rm -f "${tmpfile}"
done

echo "Re-running verification..."

# Verification: re-run the benchmark-style check
count="$(
  kubectl get roles --all-namespaces -o json | jq '
    .items[]
    | select(.rules[]?
      | (.resources[]? == "secrets")
      and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
    )' | wc -l
)"

if [ "${count}" -gt 0 ]; then
  echo "SECRETS_ACCESS_FOUND"
  echo "WARNING: Some Roles still grant get/list/watch on secrets."
  echo "They may be system or critical Roles that should be reviewed manually."
else
  echo "No Roles with get/list/watch on secrets remain."
fi