Cis Oke V180 4.1.4

4.1.4 Minimize access to create pods (Manual)

Profile Applicability

• Level 1

Description

The ability to create pods in a namespace can provide a number of opportunities for privilege escalation, such as assigning privileged service accounts to these pods or mounting hostPaths with access to sensitive data (unless Pod Security Policies are implemented to restrict this access).

As such, access to create new pods should be restricted to the smallest possible group of users.

Rationale

The ability to create pods in a cluster opens up possibilities for privilege escalation and should be restricted, where possible.

Impact

Care should be taken not to remove access to pods to system components which require this for their operation.

Audit

OKE is a standard Kubernetes cluster under the hood, so we can use kubectl auth can-i together with rolebinding lookups to get this info.

Run the following command to list all the users and service accounts that have access to create pod objects in the Kubernetes API:

echo "=== Users ==="
for user in $(kubectl get clusterrolebinding -o jsonpath='{range .items[*].subjects[?(@.kind=="User")]}{.name}{"\n"}{end}'); do
  if kubectl auth can-i create pods --as="$user" >/dev/null 2>&1; then
    echo "$user"
  fi
done

echo -e "\n=== Service Accounts ==="
for sa in $(kubectl get clusterrolebinding,rolebinding -A -o jsonpath='{range .items[*].subjects[?(@.kind=="ServiceAccount")]}{.namespace}:{.name}{"\n"}{end}'); do
  ns=$(echo "$sa" | cut -d: -f1)
  name=$(echo "$sa" | cut -d: -f2)
  if kubectl auth can-i create pods --as=system:serviceaccount:$ns:$name >/dev/null 2>&1; then
    echo "$sa"
  fi
done

• kubectl get clusterrolebinding and rolebinding return which users or service accounts are bound to roles.
• kubectl auth can-i create pods --as= checks effective permissions.
• The script loops over those bindings and prints only those who truly can create pods.

Remediation

Where possible, remove create access to pod objects in the cluster.

Default Value

By default, the following list of principals have create privileges on pod objects:

References

N/A

CIS Controls

MITRE ATT&CK Mappings