Minimize Wildcard Use Roles And Cluster Roles

kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  ) | .metadata.name' -r

kubectl get clusterrole <clusterrole-name> -o yaml > /tmp/clusterrole-<clusterrole-name>.yaml

rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

rules:
  - apiGroups: [""]
    resources:
      - pods
      - pods/log
    verbs:
      - get
      - list
      - watch

kubectl apply -f /tmp/clusterrole-<clusterrole-name>.yaml

kubectl get roles --all-namespaces -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  ) | "\(.metadata.namespace) \(.metadata.name)"' -r

kubectl get role <role-name> -n <namespace> -o yaml > /tmp/role-<namespace>-<role-name>.yaml
kubectl apply -f /tmp/role-<namespace>-<role-name>.yaml

wildcards=$(kubectl get roles --all-namespaces -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l)

wildcards_clusterroles=$(kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l)

total=$((wildcards + wildcards_clusterroles))

if [ "$total" -gt 0 ]; then
  echo "wildcards_present"
else
  echo "no_wildcards_in_roles_or_clusterroles"
fi

#!/usr/bin/env bash
set -euo pipefail

# PURPOSE:
# Identify Roles and ClusterRoles that use wildcards ("*") in rules and
# export them for manual, least-privilege review, then verify the presence
# of remaining wildcards.
#
# This script does NOT auto-edit RBAC, because the correct non-wildcard verbs,
# resources and apiGroups are application‑specific and must be chosen by an
# administrator. It is safe to re-run.

# RUN ON: Any machine with kubectl access and jq installed.

timestamp="$(date +%Y%m%d-%H%M%S)"
outdir="rbac-wildcard-review-${timestamp}"
mkdir -p "${outdir}"

echo "=== Exporting Roles with wildcard usage for review into: ${outdir} ==="

# Roles with wildcards
kubectl get roles --all-namespaces -o json | \
  jq '
    .items[]
    | select(
        .rules[]? |
        (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
      )
  ' > "${outdir}/roles-with-wildcards.json"

# ClusterRoles with wildcards
kubectl get clusterroles -o json | \
  jq '
    .items[]
    | select(
        .rules[]? |
        (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
      )
  ' > "${outdir}/clusterroles-with-wildcards.json"

echo "=== Summary of objects using wildcards (for manual hardening) ==="
echo "Roles:"
jq -r '.[].metadata | "\(.namespace)/\(.name)"' "${outdir}/roles-with-wildcards.json" 2>/dev/null || echo "  (none)"
echo "ClusterRoles:"
jq -r '.[].metadata.name' "${outdir}/clusterroles-with-wildcards.json" 2>/dev/null || echo "  (none)"

cat <<'EOF'

NEXT STEPS (manual, per benchmark remediation):
1. For each Role or ClusterRole listed above, open it for editing, for example:
   - Role:
       kubectl -n <namespace> edit role <name>
   - ClusterRole:
       kubectl edit clusterrole <name>

2. In .rules[], replace any "*" in:
   - verbs        (e.g., ["get","list","watch"] instead of ["*"])
   - resources    (e.g., ["pods","deployments"] instead of ["*"])
   - apiGroups    (e.g., ["","apps"] instead of ["*"])
   with the minimum specific values needed by the workloads.

3. Save and exit the editor to apply the updated RBAC objects.

This process is intentionally manual because the correct least-privilege set of
verbs/resources/apiGroups depends on your applications and policies.
EOF

echo
echo "=== Verification: checking for remaining wildcard usage (same logic as audit) ==="

wildcards=$(kubectl get roles --all-namespaces -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l | tr -d ' ')

wildcards_clusterroles=$(kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l | tr -d ' ')

total=$((wildcards + wildcards_clusterroles))

if [ "$total" -gt 0 ]; then
  echo "wildcards_present: ${total} Role(s)/ClusterRole(s) still contain wildcards."
  echo "Review and edit remaining items until this reports zero."
else
  echo "No wildcard usage detected in Roles or ClusterRoles."
fi