Ensure That The Cluster Admin Role Is Only Used Where Required

Manual Steps

On any machine with kubectl access, list all ClusterRoleBindings that grant cluster-admin and see who they bind to:

kubectl get clusterrolebindings \
  -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECTS_KIND:.subjects[*].kind,SUBJECTS_NAME:.subjects[*].name \
| grep 'cluster-admin'

For each binding you found, display full details (to distinguish system vs non-system subjects):
kubectl get clusterrolebinding <binding-name> -o yaml
Manually review each subject; plan to keep bindings only if they are:
- Group with name system:masters, or
- other system: prefixed subjects that are required for core components.

For any non-system user/group/service account that does not strictly require cluster-admin, design or select a least-privileged Role/ClusterRole that matches its actual needs. For example, to create a narrower ClusterRole for read-only access to pods and services:

cat << 'EOF' > readonly-pods-services-clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly-pods-services
rules:
  - apiGroups: [""]
    resources: ["pods", "services"]
    verbs: ["get", "list", "watch"]
EOF

kubectl apply -f readonly-pods-services-clusterrole.yaml

Bind the least-privileged role to the principal instead of cluster-admin, adjusting kind/name/namespace as appropriate:

Example for a user:

cat << 'EOF' > readonly-binding-user.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: readonly-pods-services-user-alice
subjects:
  - kind: User
    name: alice@example.com
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: readonly-pods-services
EOF

kubectl apply -f readonly-binding-user.yaml

Example for a service account:

cat << 'EOF' > readonly-binding-sa.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: readonly-pods-services-sa-myapp
subjects:
  - kind: ServiceAccount
    name: myapp
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: readonly-pods-services
EOF

kubectl apply -f readonly-binding-sa.yaml

After confirming that the replacement binding(s) exist and are correct, remove the excessive cluster-admin binding(s), being careful not to delete required system: bindings or the system:masters mapping:
kubectl delete clusterrolebinding <binding-name>

Verification (on any machine with kubectl access): rerun the audit, which should now return NO_CLUSTER_ADMIN_BINDINGS or only allowlist subjects:

kubectl get clusterrolebindings -o json | jq -r '
  [
    .items[]
    | select(.roleRef.name == "cluster-admin")
    | .subjects[]?
    | select(.kind != "Group" or .name != "system:masters")
  ]
  | if length == 0
    then "NO_CLUSTER_ADMIN_BINDINGS"
    else "FOUND_CLUSTER_ADMIN_BINDING"
    end
'

Using kubectl

On any machine with kubectl access:

List all ClusterRoleBindings that grant cluster-admin and inspect subjects:

kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECTS:.subjects[*].name | grep cluster-admin

For deeper inspection of a specific binding:

kubectl get clusterrolebinding <binding-name> -o yaml

For each non-system subject that does not truly require cluster-admin, create or select a least‑privileged (Cluster)Role and bind to that instead.

Example: create a narrowly scoped ClusterRole (edit as appropriate):

cat << 'EOF' | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: app-ops-readonly
rules:
  - apiGroups: [""]
    resources: ["pods","services","configmaps"]
    verbs: ["get","list","watch"]
EOF

Bind the principal to this least‑privileged ClusterRole:

cat << 'EOF' | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: app-ops-readonly-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: app-ops-readonly
subjects:
  - kind: User
    name: user@example.com
    apiGroup: rbac.authorization.k8s.io
EOF

Remove excessive cluster-admin bindings for non-system principals (do NOT delete any system: bindings or the system:masters group):

kubectl delete clusterrolebinding <binding-name>

Repeat for each binding you have replaced with a least‑privileged alternative.

Verification (on any machine with kubectl access):

kubectl get clusterrolebindings -o json | jq -r '
  [
    .items[]
    | select(.roleRef.name == "cluster-admin")
    | .subjects[]?
    | select(.kind != "Group" or .name != "system:masters")
  ]
  | if length == 0
    then "NO_CLUSTER_ADMIN_BINDINGS"
    else "FOUND_CLUSTER_ADMIN_BINDING"
    end
'

Automation

#!/usr/bin/env bash
# Purpose: Assist review of cluster-admin bindings and optionally remove non-required ones.
# Scope:   Run on any machine with kubectl access and correct context.
# Notes:   This is a MANUAL control. This script does NOT auto-delete anything without confirmation.

set -euo pipefail

echo "=== Discovering all ClusterRoleBindings to role 'cluster-admin' ==="
kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECTS:.subjects[*].name \
  | grep 'cluster-admin' || true

echo
echo "=== Detailed JSON view of non-system 'cluster-admin' subjects (for review) ==="
kubectl get clusterrolebindings -o json | jq '
  [
    .items[]
    | select(.roleRef.name == "cluster-admin")
    | {
        name: .metadata.name,
        subjects: [
          .subjects[]?
          | select(.kind != "Group" or .name != "system:masters")
        ]
      }
  ]
  | map(select(.subjects | length > 0))
'

echo
echo "======================================================================"
echo "MANUAL REVIEW REQUIRED:"
echo " 1. For each binding above, decide if the subjects truly require full"
echo "    cluster-admin. If not, design a least-privileged (Cluster)Role."
echo " 2. Create that Role/ClusterRole and bind subjects to it BEFORE removal."
echo " 3. Do NOT modify or delete any 'system:' prefixed bindings."
echo "======================================================================"
echo

read -r -p "List candidate ClusterRoleBindings (excluding 'system:' prefixes) for deletion? [y/N]: " LIST_CAND
if [[ "${LIST_CAND:-N}" =~ ^[Yy]$ ]]; then
  echo
  echo "=== Candidate ClusterRoleBindings (roleRef.name == 'cluster-admin', name does NOT start with 'system:') ==="
  kubectl get clusterrolebindings -o json | jq -r '
    .items[]
    | select(.roleRef.name == "cluster-admin")
    | select(.metadata.name | startswith("system:") | not)
    | .metadata.name
  '
fi

read -r -p "Enter a ClusterRoleBinding name to DELETE (or leave blank to skip deletion): " CRB_NAME
if [[ -n "${CRB_NAME}" ]]; then
  echo
  echo "You are about to DELETE ClusterRoleBinding: ${CRB_NAME}"
  echo "Ensure you have already created replacement least-privileged bindings as needed."
  read -r -p "Type the binding name again to confirm deletion: " CRB_CONFIRM
  if [[ "${CRB_CONFIRM}" == "${CRB_NAME}" ]]; then
    echo "Deleting ClusterRoleBinding '${CRB_NAME}'..."
    kubectl delete clusterrolebinding "${CRB_NAME}"
  else
    echo "Confirmation did not match. Skipping deletion."
  fi
else
  echo "No deletion requested. Proceeding to verification."
fi

echo
echo "=== Verification: re-running benchmark audit logic ==="
kubectl get clusterrolebindings -o json | jq -r '
  [
    .items[]
    | select(.roleRef.name == "cluster-admin")
    | .subjects[]?
    | select(.kind != "Group" or .name != "system:masters")
  ]
  | if length == 0
    then "NO_CLUSTER_ADMIN_BINDINGS"
    else "FOUND_CLUSTER_ADMIN_BINDING"
    end
'

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Ensure That The Cluster Admin Role Is Only Used Where Required

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: