Minimize Access To Create Pods

# 1) List all Roles/ClusterRoles that can create pods
# Run on: any machine with kubectl access

kubectl get clusterrole -o json | jq -r '
  .items[]
  | select(.rules[]? | any(.verbs[]?; . == "create") and any(.resources[]?; . == "pods"))
  | .metadata.name
' | sort -u

kubectl get role -A -o json | jq -r '
  .items[]
  | select(.rules[]? | any(.verbs[]?; . == "create") and any(.resources[]?; . == "pods"))
  | "\(.metadata.namespace):\(.metadata.name)"
' | sort -u

# 2) Edit the ClusterRole to remove "create" on pods
# Run on: any machine with kubectl access

kubectl get clusterrole dev-users -o yaml > dev-users-clusterrole.yaml

# BEFORE
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get","list","watch","create","delete"]

# AFTER (create removed)
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get","list","watch","delete"]

kubectl apply -f dev-users-clusterrole.yaml

# 3) Edit the Role to remove "create" on pods
# Run on: any machine with kubectl access

kubectl get role dev-role -n dev-namespace -o yaml > dev-role.yaml

kubectl apply -f dev-role.yaml

# 4) Verification: confirm that generic system:authenticated users cannot create pods
# Run on: any machine with kubectl access

kubectl auth can-i create pods --all-namespaces --as=system:authenticated

#!/usr/bin/env bash
#
# Minimize Access To Create Pods (CIS Kubernetes 5.1.4)
#
# Scope: any machine with kubectl access and credentials
#
# Behavior:
# - Enumerates all Roles and ClusterRoles that allow "create" on "pods"
# - Prints them for review
# - For each such role, interactively asks whether to remove that permission
# - If approved, patches the role rules to drop "create" on "pods" only
# - Skips system roles (kube-system, system:*)
# - Verifies using `kubectl auth can-i` at the end
#
# NOTE:
# This control is MANUAL. There is no one-size-fits-all automated fix.
# This script safely assists review and editing but always requires
# an explicit per-role decision.

set -euo pipefail

# --------- Prerequisites ---------
command -v kubectl >/dev/null 2>&1 || {
  echo "kubectl not found in PATH." >&2
  exit 1
}

echo "Using kubectl context:"
kubectl config current-context || {
  echo "No current kubectl context; configure access and re-run." >&2
  exit 1
}
echo

# --------- Helper: confirm ---------
confirm() {
  # $1 = prompt
  while true; do
    read -r -p "$1 [y/N]: " ans
    case "$ans" in
      [Yy]*) return 0 ;;
      [Nn]*|"") return 1 ;;
    esac
  done
}

# --------- Helper: patch a Role/ClusterRole to drop 'create' on 'pods' ---------
patch_role_drop_create_pods() {
  local kind="$1"  # Role or ClusterRole
  local name="$2"
  local namespace="${3:-}"

  # Build kubectl get command
  local get_cmd=(kubectl get "$kind" "$name" -o json)
  if [[ "$kind" == "Role" ]]; then
    get_cmd=(kubectl get role "$name" -n "$namespace" -o json)
  fi

  # Use jq to remove 'create' from verbs where resources include 'pods'
  # and drop any rule that ends up with empty verbs/resources/apiGroups
  local tmpfile
  tmpfile="$(mktemp)"

  "${get_cmd[@]}" \
    | jq '
      .rules |=
      (
        map(
          if ( .resources? // [] ) | index("pods") != null then
            # remove "create" from verbs
            .verbs |= map(select(. != "create"))
          else
            .
          end
        )
        # drop rules that have no verbs or no resources
        | map(select(
            (.verbs // []) | length > 0
            and
            (.resources // []) | length > 0
          ))
      )
    ' > "$tmpfile"

  # If resulting rules field is unchanged (no pod-create to remove), skip
  if diff -q <("${get_cmd[@]}") "$tmpfile" >/dev/null 2>&1; then
    echo "  No change needed (no 'create' on 'pods' found or already removed)."
    rm -f "$tmpfile"
    return 0
  fi

  echo "  Applying patch..."
  if [[ "$kind" == "Role" ]]; then
    kubectl apply -f "$tmpfile"
  else
    kubectl apply -f "$tmpfile"
  fi

  rm -f "$tmpfile"
  echo "  Patch applied."
}

# --------- Enumerate roles with create pods ---------

echo "Discovering Roles with 'create' verb on 'pods'..."
mapfile -t roles_with_create_pods < <(
  kubectl get roles --all-namespaces -o json \
    | jq -r '
        .items[]
        | select(
            any(.rules[]?; (.resources? // []) | index("pods") != null
                           and (.verbs? // []) | index("create") != null)
          )
        | "\(.metadata.namespace) \(.metadata.name)"
      '
)

echo "Discovering ClusterRoles with 'create' verb on 'pods'..."
mapfile -t clusterroles_with_create_pods < <(
  kubectl get clusterroles -o json \
    | jq -r '
        .items[]
        | select(
            any(.rules[]?; (.resources? // []) | index("pods") != null
                           and (.verbs? // []) | index("create") != null)
          )
        | .metadata.name
      '
)

echo
echo "Roles with 'create' on 'pods':"
if ((${#roles_with_create_pods[@]} == 0)); then
  echo "  (none)"
else
  printf '  %s\n' "${roles_with_create_pods[@]}"
fi

echo
echo "ClusterRoles with 'create' on 'pods':"
if ((${#clusterroles_with_create_pods[@]} == 0)); then
  echo "  (none)"
else
  printf '  %s\n' "${clusterroles_with_create_pods[@]}"
fi
echo

# --------- Interactive remediation ---------

echo "Review each role and decide whether to remove 'create' on 'pods'."
echo "System and default roles are skipped automatically."
echo

# Process namespace Roles
for line in "${roles_with_create_pods[@]}"; do
  ns="${line%% *}"
  rname="${line#* }"

  # Skip kube-system and system-critical namespaces by default
  if [[ "$ns" == "kube-system" || "$ns" == "kube-public" || "$ns" == "kube-node-lease" ]]; then
    echo "Skipping Role '$rname' in namespace '$ns' (system namespace)."
    continue
  fi

  echo
  echo "Role: $rname"
  echo "Namespace: $ns"
  echo "Current rules (filtered to pods/create):"
  kubectl get role "$rname" -n "$ns" -o json \
    | jq '
        .rules[]
        | select((.resources? // []) | index("pods") != null
                 and (.verbs? // []) | index("create") != null)
      '

  if confirm "Remove 'create' on 'pods' from this Role?"; then
    patch_role_drop_create_pods "Role" "$rname" "$ns"
  else
    echo "  Left unchanged."
  fi
done

# Process ClusterRoles
for cr in "${clusterroles_with_create_pods[@]}"; do
  # Skip system clusterroles
  if [[ "$cr" == system:* || "$cr" == "cluster-admin" || "$cr" == "admin" || "$cr" == "edit" ]]; then
    echo "Skipping ClusterRole '$cr' (commonly system/privileged role)."
    continue
  fi

  echo
  echo "ClusterRole: $cr"
  echo "Current rules (filtered to pods/create):"
  kubectl get clusterrole "$cr" -o json \
    | jq '
        .rules[]
        | select((.resources? // []) | index("pods") != null
                 and (.verbs? // []) | index("create") != null)
      '

  if confirm "Remove 'create' on 'pods' from this ClusterRole?"; then
    patch_role_drop_create_pods "ClusterRole" "$cr"
  else
    echo "  Left unchanged."
  fi
done

# --------- Final verification ---------

echo
echo "Final verification (CIS 5.1.4):"
echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"
echo
echo "Review the above result: for strict minimization, this should generally be 'no'."