Detections
Analytics

4.1.1 Ensure the cluster-admin ClusterRole is only used when required

Information

The RBAC cluster-admin ClusterRole grants full administrative authority across cluster resources and should be assigned only to approved users, groups, or service accounts with a documented operational need. GKE RBAC is intended to provide fine grained control over what users and workloads can do in the cluster.

In RBAC, GKE uses Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings to grant permissions to authenticated subjects, including users, groups, and Kubernetes service accounts. RBAC permissions are additive, so there are no deny rules to offset excessive access once a broad role is bound. GKE guidance emphasizes least privilege and recommends granting only the minimum permissions required for a task.

The cluster-admin ClusterRole grants permission to do anything on any resource in the cluster. When assigned through a ClusterRoleBinding, it provides cluster wide administrative access across all namespaces. When assigned through a RoleBinding, the ClusterRole is limited to that namespace, but it still grants the broad permissions of cluster-admin within that namespace. Where broad access is not explicitly required, create a narrower Role or ClusterRole that grants only the required API groups, resources, and verbs.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

For each cluster-admin binding, replace the broad access with a least privilege Role or ClusterRole that grants only the required API groups, resources, and verbs. Bind the replacement role to the approved user, group, or service account first, validate access, and then remove the cluster-admin binding and use least privilege and avoiding direct bindings to cluster-admin where a specific role can meet the requirement.

 -

Identify all ClusterRoleBinding and RoleBinding objects that assign the cluster-admin ClusterRole, including both cluster wide and namespace level bindings

 -

Review each bound user, group, or service account to confirm whether full administrative access is still required and documented

 -

Replace cluster-admin access where needed with a least privilege Role or ClusterRole that grants only the required API groups, resources, and verbs

 -

Bind and validate the replacement permissions before removing the existing cluster-admin binding to avoid disrupting administrative, platform, or automation workflows

 -

Remove only confirmed bindings, and avoid modifying RBAC resources with the system: prefix unless explicitly required and validated because they support cluster functionality

Impact:

Removing or modifying cluster-admin bindings without review can disrupt legitimate administrative, platform, or automation workflows. Before changing any binding, identify the subject and replace broad access with least privilege RBAC where possible. Do not delete or modify RBAC resources with the system: prefix, because GKE identifies these as required for correct cluster functionality and warns that changing them can cause cluster instability or make the cluster inaccessible.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(2), 800-53|AC-6(5), CSCv7|4.3

Plugin: GCP

Control ID: c886ec832d61e9569ab226a7b5f0f5d3b4d137819a77ba062cc02f7dfe1997fb