HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
Kubernetes Role-Based Access Control (RBAC)
Support HackTricks and get benefits!

Role-Based Access Control (RBAC)

Kubernetes has an authorization module named Role-Based Access Control (RBAC) that helps to set utilization permissions to the API server.
RBACโ€™s permission model is built from three individual parts:
  1. 1.
    Role\ClusterRole ยญโ€“ The actual permission. It contains rules that represent a set of permissions. Each rule contains resources and verbs. The verb is the action that will apply on the resource.
  2. 2.
    Subject (User, Group or ServiceAccount) โ€“ The object that will receive the permissions.
  3. 3.
    RoleBinding\ClusterRoleBinding โ€“ The connection between Role\ClusterRole and the subject.
The difference between โ€œRolesโ€ and โ€œClusterRolesโ€ is just where the role will be applied โ€“ a โ€œRoleโ€ will grant access to only one specific namespace, while a โ€œClusterRoleโ€ can be used in all namespaces in the cluster. Moreover, ClusterRoles can also grant access to:
  • cluster-scoped resources (like nodes).
  • non-resource endpoints (like /healthz).
  • namespaced resources (like Pods), across all namespaces.
From Kubernetes 1.6 onwards, RBAC policies are enabled by default. But to enable RBAC you can use something like:
1
kube-apiserver --authorization-mode=Example,RBAC --other-options --more-options
Copied!

Templates

In the template of a Role or a ClusterRole you will need to indicate the name of the role, the namespace (in roles) and then the apiGroups, resources and verbs of the role:
  • The apiGroups is an array that contains the different API namespaces that this rule applies to. For example, a Pod definition uses apiVersion: v1. It can has values such as rbac.authorization.k8s.io or [*].
  • The resources is an array that defines which resources this rule applies to. You can find all the resources with: kubectl api-resources --namespaced=true
  • The verbs is an array that contains the allowed verbs. The verb in Kubernetes defines the type of action you need to apply to the resource. For example, the list verb is used against collections while "get" is used against a single resource.

Rules Verbs

(This info was taken from here)
HTTP verb
request verb
POST
create
GET, HEAD
get (for individual resources), list (for collections, including full object content), watch (for watching an individual resource or collection of resources)
PUT
update
PATCH
patch
DELETE
delete (for individual resources), deletecollection (for collections)
Kubernetes sometimes checks authorization for additional permissions using specialized verbs. For example:
  • โ€‹PodSecurityPolicyโ€‹
    • use verb on podsecuritypolicies resources in the policy API group.
  • โ€‹RBACโ€‹
    • bind and escalate verbs on roles and clusterroles resources in the rbac.authorization.k8s.io API group.
  • โ€‹Authenticationโ€‹
    • impersonate verb on users, groups, and serviceaccounts in the core API group, and the userextras in the authentication.k8s.io API group.
You can find all the verbs that each resource support executing kubectl api-resources --sort-by name -o wide

Examples

Role
1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: Role
3
metadata:
4
namespace: defaultGreen
5
name: pod-and-pod-logs-reader
6
rules:
7
- apiGroups: [""]
8
resources: ["pods", "pods/log"]
9
verbs: ["get", "list", "watch"]
Copied!
ClusterRole
1
apiVersion: rbac.authorization.k8s.io/v1
2
kind: ClusterRole
3
metadata:
4
# "namespace" omitted since ClusterRoles are not namespaced
5
name: secret-reader
6
rules:
7
- apiGroups: [""]
8
resources: ["secrets"]
9
verbs: ["get", "watch", "list"]
Copied!
For example you can use a ClusterRole to allow a particular user to run:
1
kubectl get pods --all-namespaces
Copied!

RoleBinding and ClusterRoleBinding

A role binding grants the permissions defined in a role to a user or set of users. It holds a list of subjects (users, groups, or service accounts), and a reference to the role being granted. A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide.
1
piVersion: rbac.authorization.k8s.io/v1
2
# This role binding allows "jane" to read pods in the "default" namespace.
3
# You need to already have a Role named "pod-reader" in that namespace.
4
kind: RoleBinding
5
metadata:
6
name: read-pods
7
namespace: default
8
subjects:
9
# You can specify more than one "subject"
10
- kind: User
11
name: jane # "name" is case sensitive
12
apiGroup: rbac.authorization.k8s.io
13
roleRef:
14
# "roleRef" specifies the binding to a Role / ClusterRole
15
kind: Role #this must be Role or ClusterRole
16
name: pod-reader # this must match the name of the Role or ClusterRole you wish to bind to
17
apiGroup: rbac.authorization.k8s.io
Copied!
ClusterRoleBinding
1
apiVersion: rbac.authorization.k8s.io/v1
2
# This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
3
kind: ClusterRoleBinding
4
metadata:
5
name: read-secrets-global
6
subjects:
7
- kind: Group
8
name: manager # Name is case sensitive
9
apiGroup: rbac.authorization.k8s.io
10
roleRef:
11
kind: ClusterRole
12
name: secret-reader
13
apiGroup: rbac.authorization.k8s.io
Copied!
Permissions are additive so if you have a clusterRole with โ€œlistโ€ and โ€œdeleteโ€ secrets you can add it with a Role with โ€œgetโ€. So be aware and test always your roles and permissions and specify what is ALLOWED, because everything is DENIED by default.

Enumerating RBAC

1
# Get current privileges
2
kubectl auth can-i --list
3
# use `--as=system:serviceaccount:<namespace>:<sa_name>` to impersonate a service account
4
โ€‹
5
# List Cluster Roles
6
kubectl get clusterroles
7
kubectl describe clusterroles
8
โ€‹
9
# List Cluster Roles Bindings
10
kubectl get clusterrolebindings
11
kubectl describe clusterrolebindings
12
โ€‹
13
# List Roles
14
kubectl get roles
15
kubectl describe roles
16
โ€‹
17
# List Roles Bindings
18
kubectl get rolebindings
19
kubectl describe rolebindings
Copied!

Abuse Role/ClusterRoles for Privilege Escalation

Support HackTricks and get benefits!