Minimize Access To Secrets

kubectl get roles --all-namespaces -o wide
kubectl get roles --all-namespaces -o yaml \
  | yq 'select(.rules[]? | (.resources[]? == "secrets") and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))) | {ns: .metadata.namespace, name: .metadata.name, rules: .rules}'

kubectl get role app-role -n app-namespace -o yaml > app-role-backup.yaml

kubectl edit role app-role -n app-namespace

rules:
- apiGroups: [""]
  resources:
    - secrets
  verbs:
    - get
    - list
    - watch
    - create
    - update

rules:
- apiGroups: [""]
  resources:
    - secrets
  verbs:
    - create
    - update

kubectl apply -f app-role-backup.yaml

count=$(kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l)

echo "ROLES_WITH_SECRET_READ_VERBS=$count"

#!/usr/bin/env bash
set -euo pipefail

# Automation: Minimize access to secrets in Roles cluster-wide
# Applies to: any machine with kubectl access to the cluster
# Requirement: kubectl, jq, and a kubeconfig with sufficient RBAC rights

# This script:
#   - Finds Roles that grant get/list/watch on "secrets"
#   - Removes those verbs from the Role rules (only for resource "secrets")
#   - Leaves other resources/verbs untouched
#   - Is idempotent (safe to re-run)
#   - Verifies the result using the benchmark audit logic

# ---------- configuration ----------
# Backup directory for original Role definitions
BACKUP_DIR="./role-secrets-backups-$(date +%Y%m%d%H%M%S)"
mkdir -p "${BACKUP_DIR}"

echo "Backing up and patching Roles that grant get/list/watch on secrets..."
echo "Backups stored in: ${BACKUP_DIR}"

# ---------- function to patch a single Role ----------
patch_role() {
  local ns="$1"
  local name="$2"

  echo "Processing Role ${ns}/${name}..."

  # Backup original Role manifest
  kubectl get role "${name}" -n "${ns}" -o yaml > "${BACKUP_DIR}/${ns}__${name}.yaml"

  # Fetch Role as JSON
  role_json="$(kubectl get role "${name}" -n "${ns}" -o json)"

  # Transform rules:
  # - For rules that include "secrets" in resources:
  #     * remove get/list/watch from verbs
  #     * if verbs becomes empty, drop that rule entirely
  # - All other rules are preserved
  patched_json="$(jq '
    .rules |= [
      .[] |
      if (.resources // [] | index("secrets")) != null then
        # This rule touches secrets; clean its verbs
        .verbs |= [ .[] | select(. != "get" and . != "list" and . != "watch") ]
        | if (.verbs | length) == 0 then
            empty
          else
            .
          end
      else
        .
      end
    ]
  ' <<< "${role_json}")"

  # Apply the patched Role
  # Use kubectl replace to fully update the Role definition
  tmpfile="$(mktemp)"
  printf '%s\n' "${patched_json}" > "${tmpfile}"
  kubectl replace -f "${tmpfile}" >/dev/null
  rm -f "${tmpfile}"

  echo "Patched Role ${ns}/${name}."
}

# ---------- discover affected Roles ----------
echo "Discovering Roles with get/list/watch access to secrets..."

mapfile -t affected_roles < <(
  kubectl get roles --all-namespaces -o json \
  | jq -r '
      .items[]
      | select(.rules[]?
          | (.resources[]? == "secrets")
          and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
        )
      | "\(.metadata.namespace) \(.metadata.name)"
    ' \
  | sort -u
)

if [ "${#affected_roles[@]}" -eq 0 ]; then
  echo "No Roles with get/list/watch access to secrets found. Nothing to change."
else
  echo "Found ${#affected_roles[@]} affected Roles:"
  printf '  %s\n' "${affected_roles[@]}"
  echo

  # ---------- patch each affected Role ----------
  for entry in "${affected_roles[@]}"; do
    ns="$(cut -d' ' -f1 <<< "${entry}")"
    name="$(cut -d' ' -f2- <<< "${entry}")"
    patch_role "${ns}" "${name}"
  done
fi

# ---------- verification ----------
echo
echo "Verifying that no Roles grant get/list/watch on secrets..."

count="$(kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l | tr -d " ")"

if [ "${count}" -gt 0 ]; then
  echo "SECRETS_ACCESS_FOUND"
  echo "Verification FAILED: ${count} Roles still grant get/list/watch on secrets."
  echo "Review remaining Roles manually; some may be system or intentionally privileged."
  exit 1
else
  echo "Verification PASSED: no Roles grant get/list/watch on secrets."
fi