Minimize Access Create Pods

kubectl get clusterrole -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{range .rules[*]}{"  "}{.verbs}{" -> "}{.resources}{"\n"}{end}{"\n"}{end}' | grep -B1 "pods" | grep -B1 "create"

kubectl get clusterrolebindings -o wide

kubectl get clusterrolebinding <binding-name> -o yaml

for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
  echo "=== Namespace: $ns ==="
  kubectl get role -n "$ns" -o json | \
    jq -r '.items[] | select(.rules[]? | (.resources[]? == "pods") and (.verbs[]? == "create")) | .metadata.name'
done

for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
  echo "=== Namespace: $ns ==="
  kubectl get rolebinding -n "$ns" -o yaml | \
    grep -E "^(kind: RoleBinding|  name: |  kind: (User|Group|ServiceAccount)|  name: .*|  namespace: )"
done

kubectl get role -n prod -o yaml | grep -n "pods" -n
kubectl get rolebinding -n prod -o yaml

# As current kubectl identity
kubectl auth can-i create pods --all-namespaces

# As a specific user
kubectl auth can-i create pods --all-namespaces --as=user@example.com

# As a service account in a namespace
kubectl auth can-i create pods -n prod --as=system:serviceaccount:prod:ci-bot

#!/usr/bin/env bash
# Report who can create pods across the whole cluster
# Runs on: any machine with kubectl access and appropriate RBAC

set -euo pipefail

echo "=== Cluster-wide (non-namespaced) permissions to create pods ==="
kubectl auth can-i create pods --all-namespaces=false --as=system:anonymous 2>/dev/null || true
echo "Note: Above is a simple anonymous check; detailed RBAC is below."

echo
echo "=== Detailed RBAC: Roles/ClusterRoles that allow create on pods ==="

# 1) ClusterRoles with create on pods
echo
echo "---- ClusterRoles with 'create' on pods ----"
kubectl get clusterroles -o json \
  | jq -r '
    .items[]
    | {name: .metadata.name, rules: .rules}
    | select(.rules != null)
    | select(
        .rules[]
        | select(
            ((.verbs // []) | index("create"))
            and
            (
              ((.resources // []) | index("pods"))
              or
              ((.resources // []) | index("*"))
            )
          )
      )
    | .name' \
  | sort -u

# 2) Namespaced Roles with create on pods, grouped by namespace
echo
echo "---- Roles (namespaced) with 'create' on pods ----"
kubectl get roles --all-namespaces -o json \
  | jq -r '
    .items[]
    | {ns: .metadata.namespace, name: .metadata.name, rules: .rules}
    | select(.rules != null)
    | select(
        .rules[]
        | select(
            ((.verbs // []) | index("create"))
            and
            (
              ((.resources // []) | index("pods"))
              or
              ((.resources // []) | index("*"))
            )
          )
      )
    | "\(.ns) \(.name)"' \
  | sort -u

# 3) Bindings: who gets the above roles/clusterroles
echo
echo "=== ClusterRoleBindings (cluster-wide subjects that may create pods) ==="
kubectl get clusterrolebindings -o json \
  | jq -r '
    .items[]
    | {name: .metadata.name, roleRef: .roleRef, subjects: (.subjects // [])}
    | select(.roleRef.kind == "ClusterRole")
    | select(.roleRef.name != "")
    | "\(.name)\trole=\(.roleRef.name)\tsubjects=" +
      (if (.subjects | length) == 0 then "NONE"
       else (.subjects | map("\(.kind):\(.namespace // "-")/\(.name)") | join(","))
       end)
  ' \
  | sort

echo
echo "=== RoleBindings (namespaced subjects that may create pods) ==="
kubectl get rolebindings --all-namespaces -o json \
  | jq -r '
    .items[]
    | {ns: .metadata.namespace, name: .metadata.name, roleRef: .roleRef, subjects: (.subjects // [])}
    | "\(.ns)\t\(.name)\troleKind=\(.roleRef.kind)\troleName=\(.roleRef.name)\tsubjects=" +
      (if (.subjects | length) == 0 then "NONE"
       else (.subjects | map("\(.kind):\(.namespace // "-")/\(.name)") | join(","))
       end)
  ' \
  | sort

echo
echo "=== Summary hints ==="
cat <<'EOF'
Review focus:

1) ClusterRoles shown above, especially:
   - Roles with resources: ["*"] or including "pods"
   - Verbs including "create"
   - Roles bound to:
     * system:authenticated (all logged-in users)
     * system:serviceaccounts or system:serviceaccounts:<ns>
     * broad groups (e.g. devs, ci, platform) that do not need pod-creation rights

2) Namespaces:
   - Pay attention to production or sensitive namespaces where few identities
     should be able to create pods.

Indicators of a potential problem:

- Any ClusterRole with create on pods bound (via ClusterRoleBinding) to:
  * system:authenticated
  * system:serviceaccounts
  * large user groups not tied to a specific app/team
- RoleBindings in sensitive namespaces granting pod creation to:
  * Generic groups (e.g. "developers") instead of specific service accounts
  * Default service accounts or broad serviceaccount groups
- Roles that include:
  * resources: ["*"] and verbs: ["*"] or including "create"
  * resources including "pods" with verbs including "create"
    for subjects that do not require full pod lifecycle control.

Use this report to decide where to tighten RBAC by:
- Editing or replacing Roles/ClusterRoles to remove "create" on "pods"
- Narrowing or removing RoleBindings/ClusterRoleBindings that grant such roles
  in namespaces or to subjects that do not strictly require it.
EOF