CertGrid CertGrid
Hands-on Lab·Certified Kubernetes Security Specialist

Minimizing an Over-Broad RBAC Role

The most likely RBAC task you will be handed is not writing a Role from nothing - it is taking one that says `*` and leaving it saying as little as possible. This guide does exactly that, and proves the result by testing what is still allowed and what is now refused.

Cluster Hardening Guide 9 of 40 Intermediate

Written against the versions above. `kubectl create role --resource='*'` writes `apiGroups: [""]`, so its wildcard covers the core API group only. That is demonstrated here rather than assumed.

The cka6001 cluster: one control plane and 2 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA6001192.168.0.46Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA6001-NODE01192.168.0.47Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA6001-NODE02192.168.0.48Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. The grant you have been handed

  2. What it can actually do

  3. Decide what the workload needs, before writing anything

  4. Replace it, and notice what had to be deleted

  5. Prove it, in both directions

Official sources