No ServiceAccount Should Be Bound To cluster-admin

Manual Steps

List all ClusterRoleBindings that bind cluster-admin to any ServiceAccount (run on any machine with kubectl access):

kubectl get clusterrolebindings -o json | jq -r '
  [ .items[]
    | select(.roleRef.name == "cluster-admin")
    | .metadata as $m
    | ((.subjects // [])[] | select(.kind == "ServiceAccount"))
    | "kind=ClusterRoleBinding name=\($m.name) uid=\($m.uid) apiVersion=rbac.authorization.k8s.io/v1"
      + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
      + " sa=\(.namespace)/\(.name) roleRef=cluster-admin is_compliant=false"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

For each violating ServiceAccount, determine the minimal permissions it actually needs (run on any machine with kubectl access):
- Inspect its namespace and associated workloads:
  kubectl get sa -A kubectl get pods -A -o wide --field-selector spec.serviceAccountName=<service-account-name>
- Review application requirements (deployment manifests, documentation, and logs for authorization errors).

Create a narrowly scoped Role or ClusterRole that grants only the required verbs and resources (run on any machine with kubectl access, then apply to the cluster):

Example namespaced Role (adjust namespace, resources, verbs):

cat << 'EOF' > sa-limited-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: <workload-sa-role>
  namespace: <sa-namespace>
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
EOF

kubectl apply -f sa-limited-role.yaml

Example RoleBinding to attach it to the ServiceAccount:

cat << 'EOF' > sa-limited-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: <workload-sa-rolebinding>
  namespace: <sa-namespace>
subjects:
  - kind: ServiceAccount
    name: <service-account-name>
    namespace: <sa-namespace>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: <workload-sa-role>
EOF

kubectl apply -f sa-limited-rolebinding.yaml

After confirming the workload functions correctly with the new, least-privilege Role/RoleBinding (monitor pod logs and behavior), identify the offending ClusterRoleBinding names (run on any machine with kubectl access):

kubectl get clusterrolebindings -o json | jq -r '
  .items[]
  | select(.roleRef.name == "cluster-admin")
  | select((.subjects // [])[]? | select(.kind == "ServiceAccount"))
  | .metadata.name
' | sort -u

Delete each ClusterRoleBinding that binds any ServiceAccount to cluster-admin (run on any machine with kubectl access):

kubectl delete clusterrolebinding <clusterrolebinding-name-1>
kubectl delete clusterrolebinding <clusterrolebinding-name-2>
# repeat for all names from step 4

Verify no ServiceAccount is bound to cluster-admin (run on any machine with kubectl access):

kubectl get clusterrolebindings -o json | jq -r '
  [ .items[]
    | select(.roleRef.name == "cluster-admin")
    | .metadata as $m
    | ((.subjects // [])[] | select(.kind == "ServiceAccount"))
    | "kind=ClusterRoleBinding name=\($m.name) uid=\($m.uid) apiVersion=rbac.authorization.k8s.io/v1"
      + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
      + " sa=\(.namespace)/\(.name) roleRef=cluster-admin is_compliant=false"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

The output must be exactly:

is_compliant=true

Using kubectl

On any machine with kubectl access:

Identify violating ClusterRoleBindings and affected ServiceAccounts

kubectl get clusterrolebindings -o wide
kubectl get clusterrolebindings -o yaml | grep -A5 "name: cluster-admin"

For each ClusterRoleBinding that binds a ServiceAccount to cluster-admin, design and apply a narrowly-scoped replacement (example only; adjust rules to what the workload actually needs):

cat << 'EOF' > sa-limited-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: example-sa-limited
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]
EOF

kubectl apply -f sa-limited-role.yaml

Bind the ServiceAccount to the new Role (replace NAMESPACE and SA_NAME appropriately):

cat << 'EOF' > sa-limited-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: example-sa-limited-binding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: SA_NAME
    namespace: NAMESPACE
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: example-sa-limited
EOF

kubectl apply -f sa-limited-rolebinding.yaml

Delete the insecure ClusterRoleBinding(s)

Replace BINDING_NAME with each offending ClusterRoleBinding name:

kubectl delete clusterrolebinding BINDING_NAME

Verification

Run the benchmark audit command exactly:

kubectl get clusterrolebindings -o json | jq -r '
  [ .items[]
    | select(.roleRef.name == "cluster-admin")
    | .metadata as $m
    | ((.subjects // [])[] | select(.kind == "ServiceAccount"))
    | "kind=ClusterRoleBinding name=\($m.name) uid=\($m.uid) apiVersion=rbac.authorization.k8s.io/v1"
      + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
      + " sa=\(.namespace)/\(.name) roleRef=cluster-admin is_compliant=false"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Automation

#!/usr/bin/env bash
#
# Automation: Remove ServiceAccount bindings to cluster-admin
#
# Runs on: any machine with kubectl access and jq installed
#
# Behavior:
# - Identifies all ClusterRoleBindings that:
#     * reference roleRef.name == "cluster-admin"
#     * and have at least one ServiceAccount subject
# - Prints what it will delete
# - Deletes only those ClusterRoleBindings
# - Safe to re-run: deleting an already-removed binding is a no-op
# - Verifies compliance using the benchmark audit command

set -euo pipefail

echo "Checking for ClusterRoleBindings that bind ServiceAccounts to cluster-admin..."

# Capture current violating ClusterRoleBindings (names only, de-duplicated)
violating_crbs=$(kubectl get clusterrolebindings -o json | jq -r '
  [ .items[]
    | select(.roleRef.name == "cluster-admin")
    | select(((.subjects // [])[] | select(.kind == "ServiceAccount")) | length > 0)
    | .metadata.name
  ] | unique[]?')

if [[ -z "${violating_crbs}" ]]; then
  echo "No ClusterRoleBindings with ServiceAccounts bound to cluster-admin found."
else
  echo "The following ClusterRoleBindings bind ServiceAccounts to cluster-admin and will be deleted:"
  printf '  %s\n' ${violating_crbs}

  # Delete each violating ClusterRoleBinding
  for crb in ${violating_crbs}; do
    echo "Deleting ClusterRoleBinding: ${crb}"
    kubectl delete clusterrolebinding "${crb}"
  done
fi

echo
echo "Verification (should print 'is_compliant=true' if no violations remain):"
kubectl get clusterrolebindings -o json | jq -r '
  [ .items[]
    | select(.roleRef.name == "cluster-admin")
    | .metadata as $m
    | ((.subjects // [])[] | select(.kind == "ServiceAccount"))
    | "kind=ClusterRoleBinding name=\($m.name) uid=\($m.uid) apiVersion=rbac.authorization.k8s.io/v1"
      + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
      + " sa=\(.namespace)/\(.name) roleRef=cluster-admin is_compliant=false"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

Kubernetes

Kubernetes Misconfigurations

No ServiceAccount Should Be Bound To cluster-admin

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation