Auditing Kubernetes RBAC Permissions

Overview

Kubernetes Role-Based Access Control (RBAC) auditing systematically reviews roles, cluster roles, bindings, and service account permissions to identify overly permissive access, privilege escalation paths, and violations of least-privilege principles. Tools like rbac-tool, KubiScan, and rakkess automate discovery of dangerous permission combinations.

Prerequisites

• Kubernetes cluster with RBAC enabled (default since 1.6)
• kubectl with cluster-admin access for full audit
• rbac-tool, rakkess, or KubiScan installed

Core Concepts

RBAC Components