Minimize Access To Secrets

# 1) Discover Roles with secret read access
# Run on: any machine with kubectl access

kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )
  | {namespace: .metadata.namespace, name: .metadata.name, rules: .rules}
'

# 2) For each offending Role, export its manifest for review/edit
# Replace <namespace> and <role-name> with actual values from the command above.

kubectl get role <role-name> -n <namespace> -o yaml > /tmp/role-<namespace>-<role-name>.yaml

# 3) Edit the Role manifest locally to remove or narrow secret access
# - Remove "secrets" from resources where not strictly required
# - Or remove "get", "list", "watch" from verbs for rules that reference "secrets"
#
# Example BEFORE (snippet in the exported YAML):
# rules:
# - apiGroups: [""]
#   resources: ["pods", "secrets"]
#   verbs: ["get", "list", "watch"]
#
# Example AFTER (if secrets access not needed):
# rules:
# - apiGroups: [""]
#   resources: ["pods"]
#   verbs: ["get", "list", "watch"]
#
# Example AFTER (if write-only access to secrets is enough):
# rules:
# - apiGroups: [""]
#   resources: ["secrets"]
#   verbs: ["create", "update", "patch"]

# Edit the file with your editor of choice:
vi /tmp/role-<namespace>-<role-name>.yaml

# 4) Apply the updated Role
kubectl apply -f /tmp/role-<namespace>-<role-name>.yaml

# Re-run the audit logic to confirm no Roles grant get/list/watch on secrets
# Run on: any machine with kubectl access

count=$(kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l)

if [ "$count" -gt 0 ]; then
  echo "SECRETS_ACCESS_FOUND"
else
  echo "NO_SECRETS_READ_ACCESS_IN_ROLES"
fi

#!/usr/bin/env bash
#
# Minimize Access To Secrets (CIS GKE 4.1.2) - Automation
#
# Scope: any machine with kubectl access to the cluster
#
# Behavior:
# - Scans all Roles that grant get/list/watch on "secrets"
# - For each such Role, interactively asks whether to remove those verbs for "secrets"
# - Creates a timestamped backup of each modified Role manifest in ./role-backups/
# - Applies the sanitized Role back to the cluster
# - Re-runs the audit check at the end to verify
#
# NOTE: This is a MANUAL benchmark control. There is no one-size-fits-all fix.
#       This script helps you review and selectively remove secret access; it
#       will NOT change anything without your confirmation for each Role.
#

set -euo pipefail

# --- Pre-req checks ---------------------------------------------------------

if ! command -v kubectl >/dev/null 2>&1; then
  echo "ERROR: kubectl not found in PATH. Install/configure kubectl and re-run." >&2
  exit 1
fi

if ! command -v jq >/dev/null 2>&1; then
  echo "ERROR: jq not found in PATH. Install jq and re-run." >&2
  exit 1
fi

echo "Using kubectl context:"
kubectl config current-context || {
  echo "ERROR: No current kubectl context configured." >&2
  exit 1
}

# --- Find Roles with get/list/watch on secrets ------------------------------

echo
echo "Scanning Roles for get/list/watch access to \"secrets\"..."

roles_json=$(kubectl get roles --all-namespaces -o json)

# Count roles matching the condition
count=$(echo "${roles_json}" | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l | tr -d ' ')

if [ "${count}" -eq 0 ]; then
  echo "No Roles with get/list/watch access to secrets found. Nothing to change."
  exit 0
fi

echo "Found ${count} Role(s) with get/list/watch access to secrets."

# --- Prepare backup directory -----------------------------------------------

backup_dir="./role-backups"
mkdir -p "${backup_dir}"

timestamp=$(date +"%Y%m%d-%H%M%S")

# --- Iterate over affected Roles -------------------------------------------

echo
echo "Reviewing each affected Role. For each Role you can choose whether to"
echo "remove get/list/watch verbs from rules that apply to the \"secrets\" resource."
echo

# Extract namespace and name for each affected Role
echo "${roles_json}" | jq -r '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )
  | [.metadata.namespace, .metadata.name]
  | @tsv
' | while IFS=$'\t' read -r ns name; do
  echo "-----------------------------------------------------------------"
  echo "Role: ${name}"
  echo "Namespace: ${ns}"
  echo

  # Show current Role (rules only) for review
  kubectl get role "${name}" -n "${ns}" -o json | jq '{metadata: {name: .metadata.name, namespace: .metadata.namespace}, rules: .rules}' | sed 's/^/  /'

  echo
  read -r -p "Remove get/list/watch on \"secrets\" from this Role? [y/N]: " answer
  answer=${answer:-N}

  case "${answer}" in
    [yY][eE][sS]|[yY])
      echo "Processing Role ${ns}/${name}..."

      # Backup full manifest
      backup_file="${backup_dir}/${ns}__${name}__${timestamp}.yaml"
      kubectl get role "${name}" -n "${ns}" -o yaml > "${backup_file}"
      echo "  Backup saved to ${backup_file}"

      # Generate sanitized Role JSON:
      # - For each rule:
      #   * If "secrets" is among resources:
      #       - remove get/list/watch from verbs
      #       - keep other verbs intact
      #   * Keep rules even if secrets was the only resource; verbs for non-secret
      #     resources are unchanged by this script.
      sanitized_json=$(kubectl get role "${name}" -n "${ns}" -o json | jq '
        . as $role
        | $role
        | .rules |= (
            map(
              if (.resources? | index("secrets")) then
                .verbs |= (map(select(. != "get" and . != "list" and . != "watch")))
              else
                .
              end
            )
          )
      ')

      # Apply the sanitized Role
      echo "${sanitized_json}" | kubectl apply -f -
      echo "  Updated Role ${ns}/${name} applied."
      ;;
    *)
      echo "Skipping Role ${ns}/${name} (no changes made)."
      ;;
  esac

  echo
done

# --- Verification (re-run audit command) ------------------------------------

echo "-----------------------------------------------------------------"
echo "Re-running audit to verify remaining Roles with get/list/watch on secrets..."

verify_count=$(kubectl get roles --all-namespaces -o json | jq '
  .items[]
  | select(.rules[]?
    | (.resources[]? == "secrets")
    and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
  )' | wc -l | tr -d ' ')

if [ "${verify_count}" -gt 0 ]; then
  echo "SECRETS_ACCESS_FOUND"
  echo "Remaining Roles with get/list/watch on secrets: ${verify_count}"
  echo
  echo "You should now:"
  echo "  - Review the remaining Roles and decide if they truly need secret access."
  echo "  - Re-run this script to iteratively reduce access where appropriate."
else
  echo "No Roles with get/list/watch access to secrets remain."
  echo "Verification PASSED."
fi