Skip to content

SEC-002.md

Latest commit

 

History

History
31 lines (18 loc) · 891 Bytes

SEC-002.md

File metadata and controls

31 lines (18 loc) · 891 Bytes

SEC-002 User has cluster-admin

Summary

A user or identity is bound to cluster-admin (or equivalent). Cluster-admin has full control of the cluster; such bindings should be limited and audited.

Severity

Warning

Example

N/A

Symptoms

  • Report shows that a user has cluster-admin
  • User appears in a ClusterRoleBinding to cluster-admin (or role with equivalent privileges)

Resolution

  1. Remove cluster-admin from users who do not need cluster-wide admin
  2. Create custom ClusterRoles with only the required permissions
  3. Use groups and RBAC to grant minimal access per team or namespace
  4. Enable audit logging and review cluster-admin usage regularly

References