Minimize Cluster Access To Read-Only For Container Image Repositories

#!/usr/bin/env bash
#
# Purpose:
#   Help review CIS GKE 5.1.3 at scale by:
#     1. Listing all GKE node service accounts actually used by the cluster.
#     2. Showing their risky Storage and Artifact Registry–related IAM roles
#        at the project and (optionally) AR repository level.
#
# Usage (run on any machine with gcloud and kubectl configured):
#   export PROJECT_ID="my-gcp-project"
#   ./audit-gcr-ar-readonly.sh
#
# Optional:
#   export AR_LOCATIONS="us-central1,us,europe-west1"
#
# NOTE:
#   This only reports; it does NOT make changes. Use it to identify where
#   project or repository IAM may give more than read-only access to
#   container image repositories.

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-}"
if [[ -z "${PROJECT_ID}" ]]; then
  echo "ERROR: PROJECT_ID environment variable must be set (gcloud project ID)." >&2
  exit 1
fi

AR_LOCATIONS="${AR_LOCATIONS:-}"  # e.g. "us-central1,us,europe-west1"

echo "=== Step 1: Discover node service accounts actually in use (via kubectl) ==="

# We collect node and default service accounts referenced in node pools
# and workloads. This runs only against the Kubernetes API.
echo
echo "# Kubernetes node (GCE/GKE) underlying service accounts (from node annotations)"
kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"  "}{.metadata.annotations.container\.googleapis\.com/instance\_service\_account}{"\n"}{end}' \
  | sort -u

echo
echo "# Kubernetes workload serviceAccounts referenced in Pods (namespace/name -> GSA annotation if present)"
kubectl get pods --all-namespaces -o json \
  | jq -r '
      .items[]
      | .metadata.namespace as $ns
      | .spec.serviceAccountName as $ksa
      | .metadata.annotations["iam.gke.io/gcp-service-account"]? as $gsa
      | [$ns, .metadata.name, ($ksa // "<default>"), ($gsa // "<none>")]
      | @tsv
    ' \
  | sort -u \
  | awk 'BEGIN{OFS="\t"; print "NAMESPACE","POD","KSA","GSA_ANNOTATION"}1'

echo
echo "# Distinct GCP service accounts referenced by GKE (from node + pod annotations)"
GSA_LIST=$(
  {
    kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.annotations.container\.googleapis\.com/instance\_service\_account}{"\n"}{end}' 2>/dev/null || true
    kubectl get pods --all-namespaces -o json 2>/dev/null \
      | jq -r '.items[].metadata.annotations["iam.gke.io/gcp-service-account"] // empty'
  } \
  | sed '/^$/d' \
  | sort -u
)

if [[ -z "${GSA_LIST}" ]]; then
  echo "No GCP service accounts discovered from nodes or pods (via annotations)."
else
  echo "${GSA_LIST}" | nl -ba
fi

echo
echo "=== Step 2: Project-level IAM – risky Storage and AR-related roles ==="
echo "# These roles indicate potential write/admin access to GCR buckets or storage:"
echo "#   roles/storage.admin"
echo "#   roles/storage.objectAdmin"
echo "#   roles/storage.objectCreator"
echo "#   roles/storage.legacyBucketOwner"
echo "#   roles/storage.legacyBucketWriter"
echo "#   roles/storage.legacyObjectOwner"
echo "# and broad Artifact Registry roles (admin/writer, etc.)."

echo
echo "## Full project IAM bindings for risky Storage roles (cluster-wide):"
gcloud projects get-iam-policy "${PROJECT_ID}" \
  --flatten="bindings[].members" \
  --format='table(bindings.members,bindings.role)' \
  --filter="bindings.role:roles/storage.admin OR \
           bindings.role:roles/storage.objectAdmin OR \
           bindings.role:roles/storage.objectCreator OR \
           bindings.role:roles/storage.legacyBucketOwner OR \
           bindings.role:roles/storage.legacyBucketWriter OR \
           bindings.role:roles/storage.legacyObjectOwner"

echo
echo "## Project IAM bindings filtered to discovered GCP service accounts (Storage + Artifact Registry):"
if [[ -z "${GSA_LIST}" ]]; then
  echo "Skipping GSA-focused filter: no GCP service accounts discovered in Step 1."
else
  while read -r GSA; do
    MEMBER="serviceAccount:${GSA}"
    echo
    echo "### Service account: ${MEMBER}"
    gcloud projects get-iam-policy "${PROJECT_ID}" \
      --flatten="bindings[].members" \
      --format='table(bindings.members,bindings.role)' \
      --filter="bindings.members:${MEMBER} AND \
                (bindings.role:roles/storage. OR bindings.role:roles/artifactregistry.)"
  done <<< "${GSA_LIST}"
fi

echo
echo "=== Step 3 (optional): Artifact Registry repository-level IAM for discovered GSAs ==="

if [[ -z "${AR_LOCATIONS}" ]]; then
  echo "AR_LOCATIONS not set; skipping per-repository IAM review."
  echo "Set AR_LOCATIONS (e.g. 'us-central1,us,europe-west1') to enable."
else
  IFS=',' read -r -a LOCS <<< "${AR_LOCATIONS}"
  for LOC in "${LOCS[@]}"; do
    echo
    echo "## Listing Artifact Registry repositories in location: ${LOC}"
    gcloud artifacts repositories list \
      --project="${PROJECT_ID}" \
      --location="${LOC}" \
      --format='table(name,format)'
  done

  if [[ -n "${GSA_LIST}" ]]; then
    for LOC in "${LOCS[@]}"; do
      echo
      echo "## Per-repository IAM in ${LOC} for discovered GSAs"
      REPOS=$(gcloud artifacts repositories list \
                --project="${PROJECT_ID}" \
                --location="${LOC}" \
                --format='value(name)' || true)
      for REPO in ${REPOS}; do
        echo
        echo "### Repository: ${REPO}"
        for GSA in ${GSA_LIST}; do
          MEMBER="serviceAccount:${GSA}"
          gcloud artifacts repositories get-iam-policy "${REPO}" \
            --location="${LOC}" \
            --project="${PROJECT_ID}" \
            --flatten="bindings[].members" \
            --format='table(bindings.members,bindings.role)' \
            --filter="bindings.members:${MEMBER}"
        done
      done
    done
  fi
fi

cat <<'EOF'

INTERPRETING OUTPUT (what indicates a problem):

1) For GCR (image storage in GCS):
   Any service account used by GKE nodes or workloads that has one of these
   Storage roles – either directly on the GCR bucket or inherited at the
   PROJECT level – is overly privileged for pull-only scenarios:
     - roles/storage.admin
     - roles/storage.objectAdmin
     - roles/storage.objectCreator
     - roles/storage.legacyBucketOwner
     - roles/storage.legacyBucketWriter
     - roles/storage.legacyObjectOwner

   Expected for pull-only:
     - roles/storage.objectViewer on the specific GCR bucket
       (or equivalent read-only permission via IAM).

2) For Artifact Registry:
   For GKE-related service accounts, expected is:
     - roles/artifactregistry.reader (or custom read-only role) on the AR repo.

   Potential problems:
     - roles/artifactregistry.admin
     - roles/artifactregistry.writer
     - roles/artifactregistry.repoAdmin
     - Any other non-read-only Artifact Registry role.

This script only reports current IAM state. Use the provider console, gcloud,
or IaC to adjust roles so that cluster-related service accounts have read-only
access to image repositories wherever possible.
EOF