Minimize Access To Create Pods

Manual Steps

Identify which subjects can create pods

Run on any machine with kubectl access:

kubectl get clusterrole,role -A -o wide | grep -i pod

kubectl get clusterrole -o yaml | grep -nA5 "resources:.*pods"
kubectl get role -A -o yaml | grep -nA5 "resources:.*pods"

Inspect the exact permissions granting create on pods

Run on any machine with kubectl access:

kubectl get clusterrole -o yaml > /tmp/clusterroles.yaml
kubectl get role -A -o yaml > /tmp/roles.yaml

Open /tmp/clusterroles.yaml and /tmp/roles.yaml and search for rules like:

- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "update", "delete", ...]

Decide which roles should keep create on pods
- For each role/clusterrole you found, decide:
  - Is pod creation truly required for this role’s function?
  - Can the ability be restricted to specific namespaces (use Role instead of ClusterRole)?
  - Can pod creation be delegated to a dedicated automation account instead of broad groups like system:authenticated or system:authenticated:oauth?
- Document which Role/ClusterRole objects must be tightened and which subjects (users/groups/serviceaccounts) should retain pod-creation rights.
Remove or narrow create permissions on pods in roles/clusterroles
- To edit a ClusterRole:
  kubectl edit clusterrole <clusterrole-name>
- To edit a namespaced Role:
  kubectl edit role <role-name> -n <namespace>
- In the opened manifest, locate the rules containing resources: ["pods"] and then:
  - Remove "create" from the verbs list, or
  - If the entire rule is only for pod creation, delete that rule block.
- Save and exit to apply the change.
Adjust bindings so only intended subjects can create pods
- List bindings:
  kubectl get clusterrolebinding,rolebinding -A -o wide
- Edit any binding that grants a pod-creating role to overly broad subjects:
  kubectl edit clusterrolebinding <binding-name> kubectl edit rolebinding <binding-name> -n <namespace>
- Under subjects:, remove or replace broad subjects (for example system:authenticated, large groups) with only those users/groups/serviceaccounts that should still be able to create pods.
Verification
- Confirm that generic authenticated users can no longer create pods:
  echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"
- The output should be canCreatePodsAsSystemAuthenticated: no after remediation.

Using kubectl

On any machine with kubectl access:

Identify which RBAC bindings currently allow authenticated users to create pods

kubectl get clusterrole,role -A -o yaml \
  | grep -E "^(kind: (ClusterRole|Role)|  name: |  verbs:|  resources:)" -n

kubectl get clusterrole,role -A -o yaml \
  | awk '
    /kind: (ClusterRole|Role)/{k=$2}
    /name: /{n=$2}
    /resources:/{
      if ($2 ~ /pods/) pods=1
    }
    /verbs:/{
      if (pods && $0 ~ /create/) {
        print k":"n" allows create on pods"
      }
      pods=0
    }
  '

Then for each ClusterRole/Role you decide should not be able to create pods:

Remove create from the verbs list on pods (declarative edit)

Example: for a ClusterRole named developer that currently has create on pods, first export it:

kubectl get clusterrole developer -o yaml > developer-clusterrole.yaml

Edit developer-clusterrole.yaml and in the relevant rule(s) adjust verbs so create is removed, for example change:

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]

to:

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "update", "delete"]

Apply the change:

kubectl apply -f developer-clusterrole.yaml

Repeat this export/edit/apply pattern for each Role/ClusterRole where you want to remove pod creation.

Optionally, break unnecessary subject bindings that grant pod creation

If a specific binding should no longer grant whatever ClusterRole/Role still has pod creation, delete that binding:

# ClusterRoleBinding example
kubectl delete clusterrolebinding developer-binding

# Namespaced RoleBinding example
kubectl delete rolebinding developer-binding -n example-namespace

Or edit bindings declaratively:

kubectl get rolebinding developer-binding -n example-namespace -o yaml > rb.yaml
# edit subjects: to remove users/groups that should not create pods
kubectl apply -f rb.yaml

Verification

Run the audit command again from any machine with kubectl access:

echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"

Automation

#!/usr/bin/env bash
#
# Purpose: Minimize access to "create pods" for system:authenticated
# Scope:   Runs from any machine with kubectl access and cluster-admin privileges.
# Impact:  May break workloads or users that rely on creating Pods directly.
#          Review RBAC changes before applying in production.
#
# Behavior:
#  - Detects all Roles/ClusterRoles that grant "create" on "pods".
#  - For each, removes the "create" verb from pods while leaving all other rules intact.
#  - Idempotent: safe to re-run; if "create" is already removed, nothing changes.
#  - Verifies that system:authenticated cannot create pods cluster‑wide.

set -euo pipefail

echo "=== Checking current ability for system:authenticated to create pods ==="
kubectl auth can-i create pods --all-namespaces --as=system:authenticated || true
echo

# Temporary work directory
WORKDIR="$(mktemp -d)"
cleanup() {
  rm -rf "${WORKDIR}"
}
trap cleanup EXIT

edit_role_manifest() {
  local input="$1"
  local output="$2"

  # Use yq if available for safer YAML editing; otherwise fall back to jq+python.
  if command -v yq >/dev/null 2>&1; then
    yq '
      (.rules // []) |=
      map(
        if (.resources // [] | index("pods")) then
          .verbs |= map(select(. != "create"))
        else
          .
        end
      )
    ' "${input}" > "${output}"
  else
    # Minimal python YAML editor to remove "create" from verbs where resources include "pods"
    python3 - "$input" "$output" << 'PYEOF'
import sys, copy
import yaml

src, dst = sys.argv[1], sys.argv[2]
with open(src) as f:
    doc = yaml.safe_load(f)

rules = doc.get("rules") or []
for rule in rules:
    resources = rule.get("resources") or []
    if "pods" in resources:
        verbs = rule.get("verbs") or []
        rule["verbs"] = [v for v in verbs if v != "create"]
doc["rules"] = rules

with open(dst, "w") as f:
    yaml.safe_dump(doc, f, default_flow_style=False)
PYEOF
  fi
}

echo "=== Processing ClusterRoles that grant create on pods ==="
kubectl get clusterroles -o json | jq -r '
  .items[]
  | select(.rules != null)
  | select(
      [.rules[]
        | select(.resources != null and (.resources|index("pods") != null))
        | .verbs[]
      ] | index("create")
    )
  | .metadata.name
' | sort -u | while read -r CR; do
  [ -z "$CR" ] && continue
  echo "-> Evaluating ClusterRole: ${CR}"

  orig="${WORKDIR}/clusterrole-${CR}.yaml"
  mod="${WORKDIR}/clusterrole-${CR}-mod.yaml"

  kubectl get clusterrole "${CR}" -o yaml > "${orig}"

  edit_role_manifest "${orig}" "${mod}"

  if cmp -s "${orig}" "${mod}"; then
    echo "   No change required (create already absent for pods)."
  else
    echo "   Patching ClusterRole to remove create on pods..."
    kubectl apply -f "${mod}"
  fi
done
echo

echo "=== Processing Namespaced Roles that grant create on pods ==="
kubectl get roles --all-namespaces -o json | jq -r '
  .items[]
  | select(.rules != null)
  | select(
      [.rules[]
        | select(.resources != null and (.resources|index("pods") != null))
        | .verbs[]
      ] | index("create")
    )
  | [.metadata.namespace, .metadata.name]
  | @tsv
' | sort -u | while IFS=$'\t' read -r NS R; do
  [ -z "$NS" ] && continue
  echo "-> Evaluating Role: ${NS}/${R}"

  orig="${WORKDIR}/role-${NS}-${R}.yaml"
  mod="${WORKDIR}/role-${NS}-${R}-mod.yaml"

  kubectl get role "${R}" -n "${NS}" -o yaml > "${orig}"

  edit_role_manifest "${orig}" "${mod}"

  if cmp -s "${orig}" "${mod}"; then
    echo "   No change required (create already absent for pods)."
  else
    echo "   Patching Role to remove create on pods..."
    kubectl apply -f "${mod}"
  fi
done
echo

echo "=== Verification: can system:authenticated still create pods? ==="
RESULT="$(kubectl auth can-i create pods --all-namespaces --as=system:authenticated 2>/dev/null || true)"
echo "canCreatePodsAsSystemAuthenticated: ${RESULT}"

if [ "${RESULT}" != "no" ]; then
  echo
  echo "WARNING: system:authenticated can still create pods somewhere in the cluster."
  echo "Investigate remaining RBAC (e.g., aggregated roles, impersonation, or wildcard rules)."
else
  echo
  echo "SUCCESS: system:authenticated no longer has create permission on pods (per cluster-wide check)."
fi

Kubernetes

Kubernetes Misconfigurations

Minimize Access To Create Pods

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation