Minimize Access To Webhook Configuration Objects

# 1) List all ClusterRoles that can access admission webhook configurations
# Run on: any machine with kubectl access

kubectl get clusterroles -o json \
  | jq -r '
    .items[]
    | select(
        .rules[]
        | select(
            (.apiGroups[]? == "admissionregistration.k8s.io")
            and
            (.resources[]? | IN("validatingwebhookconfigurations","mutatingwebhookconfigurations"))
        )
      )
    | .metadata.name
  ' | sort -u

# 2) Show detailed rules for those ClusterRoles
# Replace <clusterrole-name> with a name from the previous command

kubectl get clusterrole <clusterrole-name> -o yaml

# 3) Identify who is bound to those ClusterRoles (ClusterRoleBindings)
# Run once to see all relevant ClusterRoleBindings

kubectl get clusterrolebindings -o json \
  | jq -r '
    .items[]
    | select(.roleRef.kind == "ClusterRole")
    | select(
        .roleRef.name as $r
        | $r | IN(
            # Paste the ClusterRole names from step 1 inside this IN() list, e.g.:
            "cluster-admin","admission-webhook-admin"
        )
      )
    | .metadata.name + " -> " + .roleRef.name + " :: " +
      ( .subjects // [] | map(.kind + "/" + .name) | join(",") )
  ' | sort

# 4) Inspect specific ClusterRoleBindings in detail
kubectl get clusterrolebinding <binding-name> -o yaml

# 5) Also check namespace-scoped Roles (less common but possible)
kubectl get roles --all-namespaces -o json \
  | jq -r '
    .items[]
    | select(
        .rules[]
        | select(
            (.apiGroups[]? == "admissionregistration.k8s.io")
            and
            (.resources[]? | IN("validatingwebhookconfigurations","mutatingwebhookconfigurations"))
        )
      )
    | .metadata.namespace + "/" + .metadata.name
  ' | sort -u

# 6) For any Role found in step 5, see who is bound to it
kubectl get rolebinding -A -o json \
  | jq -r '
    .items[]
    | .metadata.namespace as $ns
    | .roleRef.kind as $k
    | .roleRef.name as $r
    | select($k == "Role")
    | .metadata.name as $rb
    | .subjects // [] as $subs
    | "\($ns)/\($rb) -> \($k)/\($r) :: " + ($subs | map(.kind + "/" + .name) | join(","))
  ' | sort

# 7) Quick verification after manual adjustments (re-run scoping checks)
# ClusterRoles
kubectl get clusterroles -o json \
  | jq -r '
    .items[]
    | select(
        .rules[]
        | select(
            (.apiGroups[]? == "admissionregistration.k8s.io")
            and
            (.resources[]? | IN("validatingwebhookconfigurations","mutatingwebhookconfigurations"))
        )
      )
    | .metadata.name
  ' | sort -u

#!/usr/bin/env bash
# Report RBAC subjects with access to validating/mutating webhook configurations.
# Run on: any machine with kubectl access and current context pointing to target cluster.

set -euo pipefail

echo "=== Discovering verbs that grant access to webhook configuration resources ==="

# Collect all ClusterRoles and Roles that reference validating/mutating webhook configs
kubectl get clusterroles,roles -A -o json \
  | jq -r '
    .items[]
    | {
        kind: .kind,
        namespace: (.metadata.namespace // ""),
        name: .metadata.name,
        rules: (.rules // [])
      }
    | . as $obj
    | $obj.rules[]
    | select(
        (.resources // []) 
        | map(
            (split("/") | .[0])  # strip possible apiGroup/resource forms
          )
        | flatten
        | any(. == "validatingwebhookconfigurations" or . == "mutatingwebhookconfigurations")
      )
    | {
        kind: $obj.kind,
        namespace: $obj.namespace,
        name: $obj.name,
        apiGroups: (.apiGroups // []),
        resources: (.resources // []),
        verbs: (.verbs // [])
      }
    | @json' | sort | uniq > /tmp/webhook-access-roles.json

if [[ ! -s /tmp/webhook-access-roles.json ]]; then
  echo "No Roles or ClusterRoles directly reference validating or mutating webhook configurations."
  exit 0
fi

echo
echo "=== Roles/ClusterRoles with webhook configuration access ==="
cat /tmp/webhook-access-roles.json | jq -r '
  . as $r
  | "\($r.kind)\t\($r.namespace)\t\($r.name)\tverbs=\($r.verbs|join(","))\tresources=\($r.resources|join(","))"
' | column -t

echo
echo "=== Finding RoleBindings/ClusterRoleBindings that grant these roles ==="

# Build a list of role references of interest
role_filters=$(cat /tmp/webhook-access-roles.json | jq -r '
  . as $r
  | if $r.kind == "ClusterRole" then
      "(.kind==\"ClusterRoleBinding\" and .roleRef.kind==\"ClusterRole\" and .roleRef.name==\"\($r.name)\")"
    else
      "(.kind==\"RoleBinding\" and .roleRef.kind==\"Role\" and .roleRef.name==\"\($r.name)\" and .metadata.namespace==\"\($r.namespace)\")"
    end
' | sort -u | paste -sd " or " -)

# If there are no role filters, exit
if [[ -z "${role_filters}" ]]; then
  echo "No bindings found for the identified Roles/ClusterRoles."
  exit 0
fi

kubectl get clusterrolebindings,rolebindings -A -o json \
  | jq -r "
    .items[]
    | select(${role_filters})
    | {
        kind: .kind,
        namespace: (.metadata.namespace // \"\"),
        name: .metadata.name,
        roleKind: .roleRef.kind,
        roleName: .roleRef.name,
        subjects: (.subjects // [])
      }
    | @json" > /tmp/webhook-access-bindings.json

if [[ ! -s /tmp/webhook-access-bindings.json ]]; then
  echo "No RoleBindings or ClusterRoleBindings grant the webhook-accessing roles."
  exit 0
fi

echo
echo "=== Bindings granting access to webhook configuration objects ==="
cat /tmp/webhook-access-bindings.json | jq -r '
  . as $b
  | if ($b.subjects | length) == 0 then
      "\($b.kind)\t\($b.namespace)\t\($b.name)\trole=\($b.roleKind)/\($b.roleName)\tsubject=<none>"
    else
      $b.subjects[]
      | "\($b.kind)\t\($b.namespace)\t\($b.name)\trole=\($b.roleKind)/\($b.roleName)\tsubject=\(.kind):\(.namespace // "-"):\(.name)"
    end
' | column -t

echo
echo "=== Interpretation guidance ==="
cat <<'EOF'
Any subject listed above (User, Group, or ServiceAccount) has RBAC-granted access
to validatingwebhookconfigurations or mutatingwebhookconfigurations.

Potential problems to investigate:
- Non-admin users or broad groups (e.g., "system:authenticated", "system:serviceaccounts")
- Application-specific service accounts that should not control cluster-wide admission
- Wildcard verbs (*) or powerful verbs (create, update, patch, delete) on these resources
- ClusterRoleBindings that expose admin-like ClusterRoles to many subjects

Review each binding and decide whether the subject truly needs this level of access.
If not, update or remove the corresponding Role/ClusterRole or Binding.
EOF