documentation_complete: true


title: 'Ensure that the cluster-admin role is only used where required'

description: |-
    The RBAC role cluster-admin provides wide-ranging powers over the
    environment and should be used only where and when needed.

rationale: |-
    Kubernetes provides a set of default roles where RBAC is used. Some of these
    roles such as cluster-admin provide wide-ranging privileges which should
    only be applied where absolutely necessary. Roles such as cluster-admin
    allow super-user access to perform any action on any resource. When used in
    a ClusterRoleBinding, it gives full control over every resource in the
    cluster and in all namespaces. When used in a RoleBinding, it gives full
    control over every resource in the rolebinding's namespace, including the
    namespace itself.

severity: medium

references:
    cis@ocp4: 5.1.1
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1),CM-8(3)
    pcidss: Req-2.2,Req-7.1.2,Req-10.5.1
    srg: SRG-APP-000516-CTR-001325

ocil_clause: 'cluster-admin clusterrolebindings need review'

ocil: |-
    Review users and groups bound to cluster-admin and decide whether they
    require such access. Consider creating least-privilege roles for users and
    service accounts. Obtain a list of the users who have access to the
    cluster-admin role by reviewing the clusterrolebinding output for each role
    binding that has access to the cluster-admin role. To do this, run the
    following command:
    <pre>$ oc get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].kind | grep cluster-admin</pre>

    Care should be taken before removing any clusterrolebindings from the
    environment to ensure they are not required for operation of the cluster.
    Specifically, modifications should not be made to the default
    clusterrolebindings including those with the "system:" prefix.
