Minimize Wildcard Use In Roles And ClusterRoles

kubectl get clusterroles -o json | jq '
  .items[]
  | select(
      .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
    )
  | .metadata.name' -r

kubectl get clusterroles -o json | jq '
  .items[]
  | select(
      .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
    )'

kubectl get clusterrole <CLUSTERROLE_NAME> -o yaml

kubectl get clusterrolebindings -o json | jq '
  .items[]
  | select(.roleRef.kind=="ClusterRole" and .roleRef.name=="<CLUSTERROLE_NAME>")
  | {name: .metadata.name, subjects: .subjects}'

kubectl edit clusterrole <CLUSTERROLE_NAME>

kubectl delete clusterrole <CLUSTERROLE_NAME>

wildcards_clusterroles=$(kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l)

echo "clusterroles_with_wildcards=${wildcards_clusterroles}"

kubectl get clusterroles -o json | jq '
  .items[]
  | select(
      .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
    )
  | .metadata.name' -r

#!/usr/bin/env bash
#
# Purpose:
#   Assist review of wildcard use in ClusterRoles by exporting and listing
#   them for manual editing, then verifying reduction of wildcards.
#
# Scope:
#   Run on any machine with kubectl access to the cluster.
#
# NOTES:
#   - This check is MANUAL in the benchmark: there is no safe, generic way
#     to automatically replace "*" with specific verbs/resources/apiGroups.
#   - This script does NOT change any RBAC objects. It only:
#       * Identifies ClusterRoles using wildcards
#       * Exports them into separate YAMLs for human review/edit
#       * Helps you re-apply your edited manifests
#       * Verifies wildcard usage afterwards
#
# Requirements:
#   - kubectl installed and configured with sufficient permissions
#   - jq installed

set -euo pipefail

OUT_DIR="${OUT_DIR:-./clusterrole-wildcards-$(date +%Y%m%d%H%M%S)}"

echo "[*] Detecting ClusterRoles that use wildcards in verbs, resources, or apiGroups..."

wildcards_clusterroles_json=$(kubectl get clusterroles -o json | jq '
  .items[]
  | select(
      .rules[]?
      | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
    )
')

if [[ -z "${wildcards_clusterroles_json}" ]]; then
  echo "[*] No ClusterRoles with wildcard verbs/resources/apiGroups found."
  exit 0
fi

mkdir -p "${OUT_DIR}"

echo "${wildcards_clusterroles_json}" | jq -r '.metadata.name' | sort -u > "${OUT_DIR}/clusterroles_with_wildcards.txt"

echo "[*] ClusterRoles with wildcards:"
cat "${OUT_DIR}/clusterroles_with_wildcards.txt"
echo
echo "[*] Exporting each affected ClusterRole to individual YAML manifests in: ${OUT_DIR}"

# Export each affected ClusterRole
while read -r cr_name; do
  if [[ -z "${cr_name}" ]]; then
    continue
  fi
  out_file="${OUT_DIR}/clusterrole-${cr_name}.yaml"
  echo "  - Exporting ClusterRole/${cr_name} -> ${out_file}"
  kubectl get clusterrole "${cr_name}" -o yaml > "${out_file}"
done < "${OUT_DIR}/clusterroles_with_wildcards.txt"

cat <<'EOF'

[MANUAL ACTION REQUIRED]

1) Review each exported ClusterRole manifest in the output directory.
   For each rule, where possible:
     - Replace verbs: ["*"] with an explicit list, e.g. ["get","list","watch"]
     - Replace resources: ["*"] with explicit resources, e.g. ["pods","deployments"]
     - Replace apiGroups: ["*"] with only the required apiGroups, e.g. ["","apps"]

2) Save your edited YAML files.

3) To apply your edited ClusterRoles back to the cluster, run:

   # Replace <OUT_DIR> with the directory printed above
   kubectl apply -f <OUT_DIR>/

   (You can safely re-run this command; it is idempotent.)

EOF

read -rp "[?] Have you already edited the manifests and applied them? [y/N]: " CONFIRM
CONFIRM=${CONFIRM:-n}

if [[ "${CONFIRM}" =~ ^[Yy]$ ]]; then
  echo "[*] Verifying wildcard usage after your changes..."

  # Re-run the wildcard detection, but scoped to the previously affected ClusterRoles
  remaining=$(kubectl get clusterroles -o json | jq --argfile names "${OUT_DIR}/clusterroles_with_wildcards.txt" '
    .items[]
    | select(.metadata.name as $n | ($names | map(select(. == $n)) | length) > 0)
    | select(
        .rules[]?
        | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
      )
    | .metadata.name
  ' | sort -u || true)

  if [[ -z "${remaining}" ]]; then
    echo "[*] Verification passed: no wildcards remain in the previously flagged ClusterRoles."
  else
    echo "[!] Verification found remaining wildcards in these ClusterRoles:"
    echo "${remaining}"
    echo "[!] Please re-check these manifests and further restrict wildcard use where possible."
  fi
else
  echo "[*] Skipping verification because manifests have not been edited/applied yet."
  echo "[*] After you apply your changes, you can re-run this script to re-check."
fi