📙 RBAC Atlas: Mapping Real-World Kubernetes Permissions and Exposing Risky Projects 🏗️
summary
A tool called RBAC Atlas maps over‑permissive Kubernetes identities by running a CLI policy analyzer against Helm charts and YAML and publishing daily results on a GitHub‑hosted website. It reproduces the Ingress‑NGINX exploit chain, flags cluster role with list/watch on all secrets, and uses ~110 detection rules to scan ~25,000 artifacts across 257 projects, producing exploit steps, affected service accounts, and risk tiers so teams can prioritize fixes.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker intro
- 1:04Kubernetes 101 overview
- 3:50Kubernetes threat model
- 8:01Common attack techniques
- 12:12Privileged container exploit
- 14:39RBAC explained and risks
- 15:47Ingress Nginx vulnerability
- 22:50Introducing RBAC Atlas
- 26:40Demo and findings summary
- 29:08Q&A and closing remarks
related talks
31mKubernetes RBAC Security: A Practical Overview
49mCompromising Kubernetes Cluster by Exploiting RBAC Permissions
35mRBAC to the Future: Untangling Authorization in Kubernetes
33mAvengers Assemble: Threat Modeling Kubernetes Clusters at a...
28mClosing the Loop: Applying Least Privilege and Ensuring We Did It Well
40mEffective RBAC
56mRBAC 101: Basics, Misconceptions, and the Real World
33mHow the Basics Of Kubernetes Auth Scale For Organizations