Minimize Access To Create Pods

Manual Steps

List all Roles/ClusterRoles that can create pods

Run on: any machine with kubectl access

kubectl get roles,clusterroles -A -o json | jq '
  [.items[] |
    select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  ] | .[].metadata | {kind: .ownerReferences[0].kind, name: .name, namespace: .namespace}'

Review each listed Role/ClusterRole to determine which subjects (users/groups/serviceaccounts) really need to create pods.

Inspect a specific ClusterRole’s permissions
- Run on: any machine with kubectl access
  Replace CLUSTERROLE_NAME with the actual name:
kubectl get clusterrole CLUSTERROLE_NAME -o yaml
Identify rules where resources includes pods and verbs includes create.
Remove create on pods from a ClusterRole that should not have it
- Run on: any machine with kubectl access
  Edit the ClusterRole:
kubectl edit clusterrole CLUSTERROLE_NAME
In each rules entry that has resources: ["pods", ...] (or includes pods), remove create from the verbs list (keep other verbs like get, list, watch if still required), then save and exit.
Adjust namespace-scoped Roles similarly
- Run on: any machine with kubectl access
  For each namespace where Roles were identified:
kubectl get role ROLE_NAME -n NAMESPACE -o yaml kubectl edit role ROLE_NAME -n NAMESPACE
In rules, remove create from verbs wherever resources includes pods. Save when done.
Re-verify there are no unintended subjects that still require pod creation
- Run on: any machine with kubectl access
  For any remaining Roles/ClusterRoles that must retain pods create access (e.g., system components or trusted CI/CD), document the justification and ensure their RoleBindings/ClusterRoleBindings are scoped only to the required subjects:
kubectl get rolebinding,clusterrolebinding -A -o yaml | grep -E "name: CLUSTERROLE_NAME|subjects:"
Tighten bindings as needed (edit or delete) so only trusted subjects retain this access.

Verification

Run on: any machine with kubectl access

access=$(kubectl get roles,clusterroles -N kube-system -A -o json | jq '
  [.items[] |
    select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  ] | length')

if [ "$access" -gt 0 ]; then
  echo "pods_create_access"
else
  echo "no_pods_create_access_or_only_approved_remaining"
fi

Confirm that any remaining pods create permissions correspond only to explicitly approved, trusted Roles/ClusterRoles.

Using kubectl

On any machine with kubectl access:

Identify Roles/ClusterRoles that can create pods

kubectl get roles,clusterroles -A -o json | jq -r '
  .items[]
  | select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  | "\(.kind)/\(.metadata.name) [ns=\(.metadata.namespace // "cluster-scope")]"
'

For each offending Role/ClusterRole, fetch its manifest

Namespaced Role (replace NAMESPACE and ROLE_NAME):

kubectl get role ROLE_NAME -n NAMESPACE -o yaml > role-ROLE_NAME.yaml

ClusterRole (replace CLUSTERROLE_NAME):

kubectl get clusterrole CLUSTERROLE_NAME -o yaml > clusterrole-CLUSTERROLE_NAME.yaml

Edit the manifest(s) locally to remove create from any rule that grants it on pods.

Example before:

rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch", "create"]

Example after (remove create):

rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]

If a rule is only for create on pods, delete that rule block entirely.

Apply the updated manifest(s)

kubectl apply -f role-ROLE_NAME.yaml
kubectl apply -f clusterrole-CLUSTERROLE_NAME.yaml

(Repeat for each edited file.)

Re-run the verification

access=$(kubectl get roles,clusterroles -N -o json | jq '
  [.items[] |
    select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  ] | length')

if [ "$access" -gt 0 ]; then
  echo "pods_create_access"
else
  echo "no_pods_create_access"
fi

Automation

#!/usr/bin/env bash
set -euo pipefail

# Minimize access to create pods on Roles and ClusterRoles
# Runs on: any machine with kubectl access and current-context pointing to target cluster

# REQUIREMENTS:
# - kubectl installed and configured
# - jq installed

echo "[+] Discovering Roles/ClusterRoles with 'create' on pods..."

tmpdir="$(mktemp -d)"
trap 'rm -rf "${tmpdir}"' EXIT

# Get all roles and clusterroles in JSON
kubectl get roles,clusterroles -A -o json > "${tmpdir}/all-roles.json"

# Extract all affected Role/ClusterRole names and kinds
jq -r '
  .items[]
  | select(.rules[]? | (.resources[]? == "pods" and .verbs[]? == "create"))
  | [.kind, .metadata.name, (.metadata.namespace // "")] | @tsv
' "${tmpdir}/all-roles.json" > "${tmpdir}/affected.tsv" || true

if [ ! -s "${tmpdir}/affected.tsv" ]; then
  echo "[+] No Roles or ClusterRoles grant create on pods. Nothing to change."
else
  echo "[+] The following objects grant create on pods:"
  column -t "${tmpdir}/affected.tsv"

  echo
  echo "[!] This script will REMOVE the 'create' verb from any rule that includes 'pods'."
  echo "    It does NOT modify RoleBindings/ClusterRoleBindings, nor does it change"
  echo "    rules granting other verbs on pods."
  echo

  while IFS=$'\t' read -r kind name namespace; do
    ns_arg=()
    if [ -n "${namespace}" ] && [ "${kind}" = "Role" ]; then
      ns_arg=(--namespace "${namespace}")
    fi

    echo "[+] Processing ${kind}/${name}${namespace:+ in namespace ${namespace}}"

    # Fetch current YAML
    kubectl get "${kind}" "${name}" "${ns_arg[@]}" -o yaml > "${tmpdir}/${kind}_${namespace}_${name}.yaml"

    # Use yq if available for safer YAML manipulation; otherwise use jq+yaml round-trip through kubectl
    if command -v yq >/dev/null 2>&1; then
      # Remove 'create' verb from any rule on 'pods'
      yq '
        (.rules // [])
        |= map(
          if (.resources // [] | any(. == "pods")) and (.verbs // [] | any(. == "create")) then
            .verbs |= map(select(. != "create"))
          else
            .
          end
        )
      ' "${tmpdir}/${kind}_${namespace}_${name}.yaml" > "${tmpdir}/${kind}_${namespace}_${name}.patched.yaml"
    else
      # Fallback: convert to JSON, edit with jq, apply as YAML via kubectl.
      # This will preserve semantics but may reorder fields.
      kubectl get "${kind}" "${name}" "${ns_arg[@]}" -o json \
        | jq '
            .rules |=
              ( . // [] | map(
                  if (.resources // [] | any(. == "pods")) and (.verbs // [] | any(. == "create")) then
                    .verbs |= map(select(. != "create"))
                  else
                    .
                  end
                )
              )
          ' > "${tmpdir}/${kind}_${namespace}_${name}.patched.json"
      # Convert back to YAML via kubectl apply -f - directly from JSON
    fi

    # Apply the patched object
    if command -v yq >/dev/null 2>&1; then
      kubectl apply -f "${tmpdir}/${kind}_${namespace}_${name}.patched.yaml"
    else
      kubectl apply -f "${tmpdir}/${kind}_${namespace}_${name}.patched.json"
    fi

  done < "${tmpdir}/affected.tsv"
fi

echo
echo "[+] Verifying that no Roles or ClusterRoles grant 'create' on pods..."

access=$(kubectl get roles,clusterroles -A -o json | jq '
  [.items[] |
    select(
      .rules[]? |
      (.resources[]? == "pods" and .verbs[]? == "create")
    )
  ] | length')

if [ "${access}" -gt 0 ]; then
  echo "[-] Verification FAILED: ${access} Role(s)/ClusterRole(s) still grant 'create' on pods."
  echo "    Inspect with:"
  echo "    kubectl get roles,clusterroles -A -o json | jq -r \"
      .items[]
      | select(.rules[]? | (.resources[]? == \\\"pods\\\" and .verbs[]? == \\\"create\\\"))
      | {kind, name: .metadata.name, namespace: .metadata.namespace}
    \""
  exit 1
else
  echo "[+] Verification PASSED: no Roles or ClusterRoles grant 'create' on pods."
fi

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Minimize Access To Create Pods

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation