> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# User mgmt binaries

### Event Information

#### Meaning

* The User mgmt binaries event in a Kubernetes cluster indicates that there has been an attempt to execute a user management binary, such as `useradd` or `usermod`, within the cluster.
* This event could potentially indicate unauthorized access or an attempt to manipulate user accounts within the cluster.
* It is important to investigate this event further to ensure compliance with security and access control policies. Use the following command to check the user management binaries executed in the cluster: `kubectl get events --field-selector reason=UserMgmtBinaries`.

#### Remediation

To remediate the event "User mgmt binaries" using the Python Kubernetes API, you can follow these steps:

1. Identify the affected pod(s):
   * Use the `kubectl get pods` command to list all the pods in the cluster.
   * Filter the pods based on the labels or other criteria to identify the affected pod(s) related to the user management binaries.

2. Delete the affected pod(s):
   * Use the Python Kubernetes API to delete the identified pod(s) programmatically.
   * You can use the `client.CoreV1Api().delete_namespaced_pod()` method to delete the pod(s) by providing the pod name and namespace.

3. Verify the remediation:
   * Use the `kubectl get pods` command again to ensure that the affected pod(s) have been deleted.
   * Check the logs or any other relevant monitoring tools to confirm that the user management binaries are no longer running.

Note: Make sure to test the remediation script in a non-production environment before applying it to a production cluster.