Minimize Access Create Pods

kubectl get roles,clusterroles -A -o json | jq -r '
  .items[]
  | select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  | (.kind + "/" + .metadata.namespace + ":" + .metadata.name)
'

# View the Role YAML
kubectl -n <NAMESPACE> get role <ROLE_NAME> -o yaml > /tmp/role-<ROLE_NAME>.yaml

kubectl apply -f /tmp/role-<ROLE_NAME>.yaml

kubectl get clusterrole <CLUSTERROLE_NAME> -o yaml > /tmp/clusterrole-<CLUSTERROLE_NAME>.yaml

kubectl apply -f /tmp/clusterrole-<CLUSTERROLE_NAME>.yaml

kubectl -n <NAMESPACE> delete role <ROLE_NAME>
kubectl delete clusterrole <CLUSTERROLE_NAME>

access=$(kubectl get roles,clusterroles -N  -o json | jq '
  [.items[] |
    select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  ] | length')

if [ "$access" -eq 0 ]; then
  echo "OK: no pods create access in Roles/ClusterRoles"
else
  echo "pods_create_access still present in $access role(s)"
fi

#!/usr/bin/env bash
#
# Minimize access to create pods (CISEKS 4.1.4)
#
# This script:
#   - Lists all Roles/ClusterRoles that have "create" on "pods"
#   - Interactively removes that specific permission from each role
#   - Verifies that no roles remain with pods/create
#
# REQUIREMENTS:
#   - Run on any machine with kubectl access and cluster-admin privileges
#   - jq must be installed
#

set -euo pipefail

# Namespace to store backups of modified roles
BACKUP_NS="rbac-backup"

echo "==> Ensuring backup namespace exists: ${BACKUP_NS}"
kubectl get ns "${BACKUP_NS}" >/dev/null 2>&1 || kubectl create namespace "${BACKUP_NS}" >/dev/null

echo "==> Detecting Roles and ClusterRoles with pods/create access"

# Get all roles/clusterroles that match the condition
matches_json=$(kubectl get roles,clusterroles -A -o json | jq '
  .items
  | map(
      select(
        .rules[]? as $r
        | ($r.resources[]? == "pods" and $r.verbs[]? == "create")
      )
    )')

count=$(echo "${matches_json}" | jq 'length')

if [ "${count}" -eq 0 ]; then
  echo "No Roles or ClusterRoles grant create on pods. Nothing to do."
else
  echo "Found ${count} Roles/ClusterRoles with pods/create:"
  echo "${matches_json}" | jq -r '.[] | "\(.kind) \(.metadata.namespace // "-")/\(.metadata.name)"'
fi

# Function to strip only "create" verb from rules that target "pods"
strip_pods_create() {
  jq '
    .rules |= map(
      if (.resources? // [] | index("pods")) != null and (.verbs? // [] | index("create")) != null then
        .verbs |= (map(select(. != "create")))
      else
        .
      end
    )
    # Drop any rules that end up with no verbs
    | .rules |= map(select((.verbs // []) | length > 0))
  '
}

# Process each matching role/clusterrole
echo
echo "==> Reviewing and updating roles"

for i in $(seq 0 $((count - 1))); do
  item=$(echo "${matches_json}" | jq ".[$i]")
  kind=$(echo "${item}" | jq -r '.kind')
  name=$(echo "${item}" | jq -r '.metadata.name')
  ns=$(echo "${item}" | jq -r '.metadata.namespace // empty')

  if [ "${kind}" = "Role" ]; then
    fqname="Role/${ns}/${name}"
  else
    fqname="ClusterRole/${name}"
  fi

  echo
  echo "------------------------------------------------------------"
  echo "Processing ${fqname}"

  # Show current rules that include pods/create
  echo "Current rules including pods/create:"
  echo "${item}" | jq '.rules[] | select(.resources? // [] | index("pods")) | select(.verbs? // [] | index("create"))'

  # Skip system and well-known controller roles by default; these often need pods/create
  # You may adjust this list based on your environment.
  if [[ "${name}" =~ ^system: ]] || [[ "${name}" =~ controller ]] || [[ "${name}" =~ kubernetes-dashboard ]]; then
    echo "NOTE: ${fqname} appears to be a system or controller role."
    read -r -p "Skip modifying this role? [Y/n]: " ans
    ans=${ans:-Y}
    if [[ "${ans}" =~ ^[Yy]$ ]]; then
      echo "Skipping ${fqname}"
      continue
    fi
  fi

  read -r -p "Remove 'create' on 'pods' from this role? [y/N]: " confirm
  confirm=${confirm:-N}
  if [[ ! "${confirm}" =~ ^[Yy]$ ]]; then
    echo "User chose not to modify ${fqname}"
    continue
  fi

  # Backup current definition
  backup_name="${name}-$(date +%Y%m%d%H%M%S)"
  if [ "${kind}" = "Role" ]; then
    echo "Backing up ${fqname} to namespace ${BACKUP_NS} as role ${backup_name}"
    kubectl get role "${name}" -n "${ns}" -o yaml \
      | sed "s/^  namespace: .*/  namespace: ${BACKUP_NS}/" \
      | sed "s/^metadata:\$/metadata:\n  name: ${backup_name}/" \
      | kubectl apply -n "${BACKUP_NS}" -f -
  else
    echo "Backing up ${fqname} to namespace ${BACKUP_NS} as configmap ${backup_name}"
    kubectl get clusterrole "${name}" -o yaml \
      | kubectl create configmap "${backup_name}" -n "${BACKUP_NS}" --from-file=role.yaml=/dev/stdin --dry-run=client -o yaml \
      | kubectl apply -f -
  fi

  echo "Stripping pods/create from ${fqname} and applying updated role"

  if [ "${kind}" = "Role" ]; then
    kubectl get role "${name}" -n "${ns}" -o json \
      | strip_pods_create \
      | kubectl apply -n "${ns}" -f -
  else
    kubectl get clusterrole "${name}" -o json \
      | strip_pods_create \
      | kubectl apply -f -
  fi

  echo "Updated ${fqname}"
done

echo
echo "==> Verification: re-running pods/create access check"

access=$(kubectl get roles,clusterroles -A -o json | jq '
  [.items[] |
    select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  ] | length')

if [ "${access}" -gt 0 ]; then
  echo "pods_create_access still present in ${access} role(s). Review remaining roles manually."
  kubectl get roles,clusterroles -A -o json | jq -r '
    .items[]
    | select(
        .rules[]? |
        (.resources[]? == "pods" and .verbs[]? == "create")
      )
    | "\(.kind) \(.metadata.namespace // "-")/\(.metadata.name)"'
  exit 1
else
  echo "SUCCESS: No Roles or ClusterRoles grant create on pods."
fi