> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Limit Use Of Bind Impersonate And Escalate Permissions Kubernetes Cluster

### More Info:

Cluster roles and roles with the impersonate, bind or escalate permissions should not be granted unless strictly required. Each of these permissions allow a particular subject to escalate their privileges beyond those explicitly granted by cluster administrators

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **List all Roles/ClusterRoles that grant `bind`, `escalate`, or `impersonate`.**
           * Run on: any machine with kubectl access
           * Command:
             ```bash theme={null}
             kubectl get clusterroles -o json | jq -r '
               .items[]
               | select(
                   (.rules // [])
                   | map(
                       (.verbs // [])
                       | map(. == "bind" or . == "escalate" or . == "impersonate")
                       | any
                     )
                 )
               | .metadata.name
             '
             ```
             ```bash theme={null}
             kubectl get roles --all-namespaces -o json | jq -r '
               .items[]
               | select(
                   (.rules // [])
                   | map(
                       (.verbs // [])
                       | map(. == "bind" or . == "escalate" or . == "impersonate")
                       | any
                     )
                 )
               | [.metadata.namespace, .metadata.name] | @tsv
             '
             ```

        2. **Identify which subjects (users, groups, service accounts) are bound to those high‑risk Roles/ClusterRoles.**
           * Run on: any machine with kubectl access
           * Command:
             ```bash theme={null}
             kubectl get clusterrolebindings -o json | jq -r '
               .items[]
               | . as $crb
               | ($crb.roleRef.name) as $role
               | $role as $r
               | $r
             ' | sort -u
             ```
             Then correlate with the list from step 1:
             ```bash theme={null}
             kubectl get clusterrolebindings -o json | jq -r '
               .items[]
               | select(.roleRef.kind == "ClusterRole")
               | . as $crb
               | $crb.roleRef.name as $role
               | $crb.subjects[]? as $s
               | [$role, $s.kind, $s.namespace // "", $s.name] | @tsv
             '
             ```
             ```bash theme={null}
             kubectl get rolebindings --all-namespaces -o json | jq -r '
               .items[]
               | . as $rb
               | [$rb.metadata.namespace, $rb.roleRef.kind, $rb.roleRef.name] as $info
               | $rb.subjects[]? as $s
               | [$info[], $s.kind, $s.namespace // "", $s.name] | @tsv
             '
             ```

        3. **Review business and technical justification for each subject with these permissions.**
           * For each subject identified in step 2, determine:
             * Why do they need `bind`, `escalate`, or `impersonate`?
             * Is it documented and approved (e.g., admin break-glass, CI/CD controller, identity broker)?
           * If no clear, minimal justification exists, mark that binding for removal or reduction (e.g., to a narrower role without these verbs).

        4. **Remove or tighten unnecessary `bind`/`escalate`/`impersonate` permissions.**
           * Run on: any machine with kubectl access
           * To remove a binding entirely (example – replace with actual names from your review):
             ```bash theme={null}
             kubectl delete clusterrolebinding <clusterrolebinding-name>
             ```
             ```bash theme={null}
             kubectl delete rolebinding -n <namespace> <rolebinding-name>
             ```
           * To edit and drop only the risky verbs from an otherwise needed role:
             ```bash theme={null}
             kubectl edit clusterrole <clusterrole-name>
             ```
             or
             ```bash theme={null}
             kubectl edit role -n <namespace> <role-name>
             ```
             Then remove `bind`, `escalate`, and `impersonate` from `.rules[].verbs` while preserving required non‑escalating verbs.

        5. **If a subject genuinely needs some of these rights, scope them as narrowly as possible.**
           * Prefer dedicated, minimal Roles/ClusterRoles with just the necessary resources and verbs (e.g., only impersonate specific users/groups, only bind to a specific role).
           * Create/update via manifest so the intent is explicit (example skeleton):
             ```yaml theme={null}
             apiVersion: rbac.authorization.k8s.io/v1
             kind: ClusterRole
             metadata:
               name: scoped-impersonator
             rules:
               - apiGroups: [""]
                 resources: ["users"]
                 resourceNames: ["specific-user"]
                 verbs: ["impersonate"]
             ```
           * Apply:
             ```bash theme={null}
             kubectl apply -f scoped-impersonator.yaml
             ```

        6. **Verify that high‑risk verbs are now only where explicitly approved.**
           * Run on: any machine with kubectl access
           * Re-run the discovery from step 1 and confirm the remaining Roles/ClusterRoles with `bind`, `escalate`, or `impersonate` match your approved list:
             ```bash theme={null}
             kubectl get clusterroles -o json | jq -r '
               .items[]
               | select(
                   (.rules // [])
                   | map(
                       (.verbs // [])
                       | map(. == "bind" or . == "escalate" or . == "impersonate")
                       | any
                     )
                 )
               | .metadata.name
             '
             ```
             ```bash theme={null}
             kubectl get roles --all-namespaces -o json | jq -r '
               .items[]
               | select(
                   (.rules // [])
                   | map(
                       (.verbs // [])
                       | map(. == "bind" or . == "escalate" or . == "impersonate")
                       | any
                     )
                 )
               | [.metadata.namespace, .metadata.name] | @tsv
             '
             ```
      </Accordion>

      <Accordion title="Using kubectl">
        ```bash theme={null}
        # 1) List all ClusterRoles that contain bind, impersonate, or escalate
        # Run on: any machine with kubectl access
        kubectl get clusterroles -o json | jq -r '
          .items[]
          | select(
              [.rules[].verbs?] | flatten | map(tostring)
              | any(. == "bind" or . == "impersonate" or . == "escalate")
            )
          | .metadata.name
        '
        ```

        **Problem indication:**\
        Any ClusterRole name returned by this command includes at least one of the sensitive verbs. These roles need review to see who is bound to them and whether this is strictly required.

        ***

        ```bash theme={null}
        # 2) Show full definitions of ClusterRoles with these verbs
        for cr in $(kubectl get clusterroles -o json | jq -r '
          .items[]
          | select(
              [.rules[].verbs?] | flatten | map(tostring)
              | any(. == "bind" or . == "impersonate" or . == "escalate")
            )
          | .metadata.name
        '); do
          echo "### ClusterRole: $cr"
          kubectl get clusterrole "$cr" -o yaml
          echo
        done
        ```

        **Problem indication:**\
        Within each role’s `.rules`:

        * `verbs` containing `bind`, `escalate`, or `impersonate` against broad `resources` (e.g., `*`, `clusterroles`, `users`, `groups`) or `resourceNames` not narrowly scoped is higher risk.\
          These should be justified by a concrete operational need.

        ***

        ```bash theme={null}
        # 3) Find RoleBindings that refer to those ClusterRoles
        # (who gets these powerful ClusterRoles, across all namespaces)
        for cr in $(kubectl get clusterroles -o json | jq -r '
          .items[]
          | select(
              [.rules[].verbs?] | flatten | map(tostring)
              | any(. == "bind" or . == "impersonate" or . == "escalate")
            )
          | .metadata.name
        '); do
          echo "### RoleBindings referencing ClusterRole: $cr"
          kubectl get rolebindings --all-namespaces -o json | jq -r --arg CR "$cr" '
            .items[]
            | select(.roleRef.kind == "ClusterRole" and .roleRef.name == $CR)
            | [.metadata.namespace, .metadata.name] | @tsv
          ' | column -t
          echo
        done
        ```

        **Problem indication:**\
        Any RoleBinding shown here grants a subject (user, group, or ServiceAccount) access to a ClusterRole that has `bind`, `impersonate`, or `escalate`. Each binding must be checked for least-privilege necessity.

        ***

        ```bash theme={null}
        # 4) Find ClusterRoleBindings that refer to those ClusterRoles
        for cr in $(kubectl get clusterroles -o json | jq -r '
          .items[]
          | select(
              [.rules[].verbs?] | flatten | map(tostring)
              | any(. == "bind" or . == "impersonate" or . == "escalate")
            )
          | .metadata.name
        '); do
          echo "### ClusterRoleBindings referencing ClusterRole: $cr"
          kubectl get clusterrolebindings -o json | jq -r --arg CR "$cr" '
            .items[]
            | select(.roleRef.kind == "ClusterRole" and .roleRef.name == $CR)
            | .metadata.name
          '
          echo
        done
        ```

        **Problem indication:**\
        ClusterRoleBindings are cluster-wide. Any binding here grants powerful permissions everywhere; these are high-risk and should be tightly justified and, where possible, replaced with narrower, namespace-scoped permissions.

        ***

        ```bash theme={null}
        # 5) Inspect the subjects for each risky binding (who exactly has them)
        echo "### ClusterRoleBindings with subjects and sensitive verbs"
        kubectl get clusterroles,clusterrolebindings,rolebindings --all-namespaces -o json | jq -r '
          def has_sensitive_verbs:
            (.rules // [])
            | map(.verbs // [])
            | flatten
            | map(tostring)
            | any(. == "bind" or . == "impersonate" or . == "escalate");

          .items[]
          | select(.kind == "ClusterRole" and has_sensitive_verbs) as $cr
          | $cr.metadata.name as $crName
          | $cr
          |
          (
            # ClusterRoleBindings
            (input // empty)
            | .items[]
            | select(.kind == "ClusterRoleBinding" and .roleRef.kind == "ClusterRole" and .roleRef.name == $crName)
            | "ClusterRole: \($crName) | ClusterRoleBinding: \(.metadata.name) | Subjects: \(.subjects // [] | map(.kind + \"/\" + .name) | join(\",\"))"
          )' 2>/dev/null
        ```

        *(If the combined jq is too complex in your environment, manually inspect each binding found in steps 3 and 4 using `kubectl get <binding> -o yaml`.)*

        **Problem indication:**\
        Look for:

        * Subjects that are broad (e.g., `system:authenticated`, `system:serviceaccounts`, large groups).
        * Service accounts used by application workloads rather than dedicated infrastructure/automation components.
        * Human users or groups who do not administratively need to bind/impersonate/escalate.

        ***

        ```bash theme={null}
        # 6) Verify after review and changes (re-run discovery)
        kubectl get clusterroles -o json | jq -r '
          .items[]
          | select(
              [.rules[].verbs?] | flatten | map(tostring)
              | any(. == "bind" or . == "impersonate" or . == "escalate")
            )
          | .metadata.name
        '
        ```

        **Verification interpretation:**

        * If this returns no ClusterRole names, no ClusterRole currently declares `bind`, `impersonate`, or `escalate`.
        * If it still returns entries, those roles (and their bindings) remain and must be consciously accepted or further reduced.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Report Roles/ClusterRoles and their bindings that grant bind/impersonate/escalate
        # Run on: any machine with kubectl access and current-context set to target cluster

        set -euo pipefail

        echo "=== 1) Roles and ClusterRoles containing bind/impersonate/escalate verbs ==="
        echo

        # List ClusterRoles with these verbs
        echo "--- ClusterRoles with bind/impersonate/escalate ---"
        kubectl get clusterroles -o json \
          | jq -r '
            .items[]
            | . as $cr
            | ($cr.rules // [])
            | map(
                select(
                  (.verbs // []) 
                  | map(ascii_downcase) 
                  | map(select(. == "bind" or . == "impersonate" or . == "escalate")) 
                  | length > 0
                )
              )
            | select(length > 0)
            | $cr.metadata.name
          ' | sort -u

        echo
        # List Roles per-namespace with these verbs
        echo "--- Roles with bind/impersonate/escalate (namespaced) ---"
        kubectl get roles --all-namespaces -o json \
          | jq -r '
            .items[]
            | . as $r
            | ($r.rules // [])
            | map(
                select(
                  (.verbs // []) 
                  | map(ascii_downcase) 
                  | map(select(. == "bind" or . == "impersonate" or . == "escalate")) 
                  | length > 0
                )
              )
            | select(length > 0)
            | "\($r.metadata.namespace)\t\($r.metadata.name)"
          ' | sort -u

        echo
        echo "=== 2) ClusterRoleBindings that reference ClusterRoles above ==="
        echo

        # Capture suspect clusterroles for reuse
        suspect_crs=$(kubectl get clusterroles -o json \
          | jq -r '
            .items[]
            | . as $cr
            | ($cr.rules // [])
            | map(
                select(
                  (.verbs // []) 
                  | map(ascii_downcase) 
                  | map(select(. == "bind" or . == "impersonate" or . == "escalate")) 
                  | length > 0
                )
              )
            | select(length > 0)
            | $cr.metadata.name
          ' | sort -u)

        if [ -z "$suspect_crs" ]; then
          echo "No ClusterRoles with bind/impersonate/escalate verbs found."
        else
          echo "ClusterRoles with sensitive verbs: "
          printf '  %s\n' $suspect_crs
          echo
          echo "ClusterRoleBindings granting these ClusterRoles:"
          kubectl get clusterrolebindings -o json \
            | jq -r --argjson crs "$(printf '%s\n' $suspect_crs | jq -R . | jq -s .)" '
                .items[]
                | select(.roleRef.kind == "ClusterRole")
                | select(.roleRef.name as $rn | $crs | index($rn) != null)
                | .metadata.name as $crb
                | .roleRef.name as $role
                | (.subjects // [])[]?
                | "\($crb)\t\($role)\t\(.kind)\t\(.namespace // "-")\t\(.name)"
              ' | sort -u \
            | awk 'BEGIN { OFS="\t"; print "CRB_NAME","CLUSTERROLE","SUBJECT_KIND","SUBJECT_NAMESPACE","SUBJECT_NAME" } 1'
        fi

        echo
        echo "=== 3) RoleBindings that reference Roles above (namespaced) ==="
        echo

        # Capture suspect roles (namespaced)
        suspect_roles=$(kubectl get roles --all-namespaces -o json \
          | jq -r '
            .items[]
            | . as $r
            | ($r.rules // [])
            | map(
                select(
                  (.verbs // []) 
                  | map(ascii_downcase) 
                  | map(select(. == "bind" or . == "impersonate" or . == "escalate")) 
                  | length > 0
                )
              )
            | select(length > 0)
            | "\($r.metadata.namespace)\t\($r.metadata.name)"
          ' | sort -u)

        if [ -z "$suspect_roles" ]; then
          echo "No Namespaced Roles with bind/impersonate/escalate verbs found."
        else
          echo "Roles with sensitive verbs (NAMESPACE,ROLE):"
          printf '  %s\n' $suspect_roles
          echo
          echo "RoleBindings granting these Roles:"
          kubectl get rolebindings --all-namespaces -o json \
            | jq -r --argjson roles "$(printf '%s\n' "$suspect_roles" | jq -R . | jq -s .)" '
                .items[]
                | . as $rb
                | select(.roleRef.kind == "Role")
                | ($rb.metadata.namespace + "\t" + .roleRef.name) as $key
                | $roles
                | index($key) as $idx
                | select($idx != null)
                | $rb.metadata.name as $rbname
                | .roleRef.name as $rolename
                | $rb.metadata.namespace as $ns
                | (.subjects // [])[]?
                | "\($ns)\t\($rbname)\t\($rolename)\t\(.kind)\t\(.namespace // "-")\t\(.name)"
              ' | sort -u \
            | awk 'BEGIN { OFS="\t"; print "NAMESPACE","RB_NAME","ROLE","SUBJECT_KIND","SUBJECT_NAMESPACE","SUBJECT_NAME" } 1'
        fi

        echo
        echo "=== 4) Direct use of 'impersonate' verb in any Role/ClusterRole ==="
        echo
        echo "--- Raw summary (for deeper review) ---"
        kubectl get clusterroles,roles --all-namespaces -o json \
          | jq -r '
              .items[]
              | . as $obj
              | ($obj.rules // [])
              | map(
                  select(
                    (.verbs // []) 
                    | map(ascii_downcase) 
                    | index("impersonate") != null
                  )
                )
              | select(length > 0)
              | "\($obj.kind)\t\($obj.metadata.namespace // "-")\t\($obj.metadata.name)"
            ' | sort -u \
          | awk 'BEGIN { OFS="\t"; print "KIND","NAMESPACE","NAME_WITH_IMPERSONATE" } 1'
        ```

        **How to interpret the output**

        * Any `ClusterRole` or `Role` listed in sections 1 or 4 uses `bind`, `impersonate`, or `escalate`.
        * Any binding listed in sections 2 and 3 shows *who* (users, groups, service accounts) receives those powerful permissions.
        * Problematic cases are subjects that do not absolutely need these capabilities (for example, broad groups like `system:authenticated`, CI/CD service accounts, or general application service accounts).
        * Use this report to decide, manually, where you can safely:
          * Remove the binding, or
          * Replace with a less-privileged role that omits `bind`, `impersonate`, and `escalate`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://www.impidio.com/blog/kubernetes-rbac-security-pitfalls](https://www.impidio.com/blog/kubernetes-rbac-security-pitfalls)