v0.8.0

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list

v0.7.0

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list

v0.6.2 🚀

Changes

• Fixed Rule rendering in HTML

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Examples:

rbac-tool  lookup

rbac-tool  viz

rbac-tool  gen --generated-type=Role --deny-resources=secrets.,daemonsets.apps --allowed-verbs=get,list --allowed-groups=,apps,networking.k8s.io

v0.6.1 🚀

Changes

• Fix HTML rendering @gadinaor (#9)

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Examples:

rbac-tool  lookup

rbac-tool  viz

rbac-tool  gen --generated-type=Role --deny-resources=secrets.,daemonsets.apps --allowed-verbs=get,list --allowed-groups=,apps,networking.k8s.io

v0.6.0 🚀

Changes

• Visualize specific subjects @gadinaor (#7)
• Docs Update @gadinaor (#6)

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Examples:

$ rbac-tool  lookup

$ rbac-tool  viz 
$ rbac-tool viz --include-pods-only
$ rbac-tool viz --include-subjects="nginx-ingress"

rbac-tool  gen --generated-type=Role --deny-resources=secrets.,daemonsets.apps --allowed-verbs=get,list --allowed-groups=,apps,networking.k8s.io

v0.5.0

Changes

• Added rbac lookup roles/clusterroles used by user/group/serviceaccount @gadinaor (#4)
• Added support to create RBAC graph from files and stdin

rbac-tool

Example:

rbac-tool  lookup

rbac-tool  viz

rbac-tool  gen --generated-type=Role --deny-resources=secrets.,daemonsets.apps --allowed-verbs=get,list --allowed-groups=,apps,networking.k8s.io

v0.4.0 🚀

Changes

• rbac-tool visualize @gadinaor (#2)

rbac-tool

Generate Role or ClusterRole resource while reducing the use of wildcards.

rbac-tool read from the Kubernetes discovery API the available API Groups and resources,
and based on the command line options, generate an explicit Role/ClusterRole that avoid wildcards

Example:

rbac-tool  gen --generated-type=Role --deny-resources=secrets.,daemonsets.apps --allowed-verbs=get,list --allowed-groups=,apps,networking.k8s.io

v0.3.0

Changes

• initial release of rbac-tool gen

rbac-tool gen

Generate Role or ClusterRole resource while reducing the use of wildcards.

rbac-tool read from the Kubernetes discovery API the available API Groups and resources,
and based on the command line options, generate an explicit Role/ClusterRole that avoid wildcards

Example:

rbac-tool  gen --generated-type=Role --deny-resources=secrets.,daemonsets.apps --allowed-verbs=get,list --allowed-groups=,apps,networking.k8s.io

v0.1 - initial release

Merge pull request #1 from alcideio/initial-release

Merge initial release