Minimize Access Secrets

#!/usr/bin/env bash
#
# Minimize access to secrets (CIS GKE 4.1.2)
#
# Runs on: any machine with kubectl access and jq installed
#
# Behavior:
# - Enumerates all Roles that grant get/list/watch on "secrets"
# - Prints them for review
# - Interactively offers to remove get/list/watch on "secrets" from each matching rule
# - Applies changes via kubectl patch (idempotent)
# - Verifies that no Roles still grant get/list/watch on "secrets"
#
# NOTE: This is a MANUAL control; this script assists review but
# final decisions must be made by an administrator who understands
# which Roles truly need access to secrets (for example, controllers
# or operators that must read secrets to function).

set -euo pipefail

require_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "ERROR: '$1' is required but not installed or not in PATH." >&2
    exit 1
  fi
}

require_cmd kubectl
require_cmd jq

echo "=== Enumerating Roles with get/list/watch access to secrets ==="

# Collect Roles with get/list/watch on secrets
roles_json=$(kubectl get roles --all-namespaces -o json)
matches=$(echo "$roles_json" | jq -r '
  .items[]
  | select(
      .rules[]?
      | (.resources[]? == "secrets")
      and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
    )
  | "\(.metadata.namespace) \(.metadata.name)"
')

if [ -z "$matches" ]; then
  echo "No Roles currently grant get/list/watch on secrets."
  exit 0
fi

echo "The following Roles grant get/list/watch access to secrets:"
echo "$matches" | awk '{printf "  - Namespace: %-30s Role: %s\n", $1, $2}'

echo
echo "For each Role, you must decide if it truly requires get/list/watch on secrets."
echo "This script can remove those verbs only from rules that target the \"secrets\" resource."
echo "Other resources and verbs in the same Role are preserved."

read -r -p "Proceed with interactive cleanup of these Roles? [y/N]: " PROCEED
PROCEED=${PROCEED:-n}
if [[ ! "$PROCEED" =~ ^[Yy]$ ]]; then
  echo "Aborting. No changes made."
  exit 0
fi

# Function to build a patched Role JSON with minimized secret access
build_patched_role() {
  local ns="$1"
  local name="$2"

  # Extract the Role, then rewrite rules:
  # - For each rule that includes "secrets":
  #   * remove get/list/watch from verbs for that rule
  #   * if no verbs remain, drop the rule entirely
  # - Other rules untouched
  kubectl get role "$name" -n "$ns" -o json | jq '
    .rules |= (
      map(
        if (.resources // [] | index("secrets")) != null then
          # rule targeting secrets: strip get/list/watch
          .verbs |= map(select(. != "get" and . != "list" and . != "watch")) |
          if (.verbs | length) == 0 then
            # drop rule with no remaining verbs
            empty
          else
            .
          end
        else
          .
        end
      )
    )
  '
}

# Process each Role interactively
echo
echo "=== Processing Roles ==="
echo

while read -r ns name; do
  [ -z "$ns" ] && continue
  echo "Role: $name"
  echo "Namespace: $ns"
  echo

  echo "Current rules for this Role:"
  kubectl get role "$name" -n "$ns" -o json | jq '.rules' | sed 's/^/  /'
  echo

  read -r -p "Remove get/list/watch access on secrets for this Role? [y/N]: " ANSWER
  ANSWER=${ANSWER:-n}
  if [[ ! "$ANSWER" =~ ^[Yy]$ ]]; then
    echo "Skipping $ns/$name"
    echo
    continue
  fi

  echo "Building patched Role without get/list/watch on secrets..."
  patched_json=$(build_patched_role "$ns" "$name")

  echo "Resulting rules will be:"
  echo "$patched_json" | jq '.rules' | sed 's/^/  /'
  echo

  read -r -p "Apply this change to $ns/$name? [y/N]: " APPLY
  APPLY=${APPLY:-n}
  if [[ ! "$APPLY" =~ ^[Yy]$ ]]; then
    echo "Skipping apply for $ns/$name"
    echo
    continue
  fi

  # Apply patch idempotently
  echo "$patched_json" | kubectl apply -n "$ns" -f -
  echo "Updated $ns/$name"
  echo
done <<< "$matches"

echo "=== Verification ==="
echo "Re-running check for Roles with get/list/watch on secrets ..."

count=$(kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l | tr -d ' ')

if [ "$count" -gt 0 ]; then
  echo "SECRETS_ACCESS_FOUND"
  echo "There are still Roles with get/list/watch on secrets."
  echo "Review them manually with:"
  echo "  kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[]? | (.resources[]? == \"secrets\") and ((.verbs[]? == \"get\") or (.verbs[]? == \"list\") or (.verbs[]? == \"watch\"))) | \"Namespace: \(.metadata.namespace)  Role: \(.metadata.name)\"'"
  exit 1
else
  echo "No Roles currently grant get/list/watch on secrets."
fi

echo "Done."