Anthropic-Cybersecurity-Skills/skills/auditing-kubernetes-cluster-rbac/references/api-reference.md

API Reference: Auditing Kubernetes Cluster RBAC

kubernetes (Python Client)

Configuration

from kubernetes import client, config

config.load_kube_config()  # From ~/.kube/config
# or
config.load_incluster_config()  # Inside a pod

List ClusterRoles

rbac = client.RbacAuthorizationV1Api()
roles = rbac.list_cluster_role()
for role in roles.items:
    print(role.metadata.name)
    for rule in role.rules or []:
        print(f"  verbs={rule.verbs} resources={rule.resources}")

List ClusterRoleBindings

bindings = rbac.list_cluster_role_binding()
for b in bindings.items:
    print(b.metadata.name, "->", b.role_ref.name)
    for s in b.subjects or []:
        print(f"  {s.kind}: {s.name}")

List Pods (Security Context)

v1 = client.CoreV1Api()
pods = v1.list_pod_for_all_namespaces()
for pod in pods.items:
    for c in pod.spec.containers:
        sc = c.security_context
        if sc and sc.privileged:
            print(f"PRIVILEGED: {pod.metadata.namespace}/{pod.metadata.name}")

Key RBAC Resources

Resource	API	Description
ClusterRole	rbac.list_cluster_role()	Cluster-wide permission definitions
ClusterRoleBinding	rbac.list_cluster_role_binding()	Binds roles to subjects cluster-wide
Role	rbac.list_namespaced_role(ns)	Namespace-scoped permissions
RoleBinding	rbac.list_namespaced_role_binding(ns)	Namespace-scoped binding
ServiceAccount	v1.list_service_account_for_all_namespaces()	Pod identities

Dangerous RBAC Patterns to Detect

Pattern	Risk
verbs: ["*"], resources: ["*"]	Equivalent to cluster-admin
resources: ["secrets"], verbs: ["get"]	Can read all secrets
resources: ["pods/exec"]	Can exec into containers
subjects: system:authenticated	All users get this role
automountServiceAccountToken: true	Token available in pod

References

• kubernetes Python client: https://pypi.org/project/kubernetes/
• K8s RBAC docs: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
• KubiScan: https://github.com/cyberark/KubiScan