Skip to content

Releases: alcideio/rbac-tool

v1.2.0

20 Jul 11:55
@github-actions github-actions
v1.2.0
fe9c542
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.0

insightCloudSec | insightCloudSec | RBAC TOOL

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

Standalone

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

kubectl plugin // krew //

$ kubectl krew install rbac-tool

Command Line Examples (Standalone)

# Show which users/groups/service accounts are allowed to read secrets in the cluster pointed by kubeconfig
rbac-tool who-can get secrets

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list

kubectl rbac-tool ...

# Generate HTML visualzation of your RBAC permissions
kubectl rbac-tool viz

# Query who can read secrets
kubectl rbac-tool who-can get secret

# Generate a ClusterRole policy that allows to read everything except secrets and services
kubectl rbac-tool gen --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v1.1.4

19 Jul 11:55
@github-actions github-actions
v1.1.4
7e400f3
Compare
Choose a tag to compare
v1.1.4

insightCloudSec | insightCloudSec | RBAC TOOL

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

Standalone

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

kubectl plugin // krew //

$ kubectl krew install rbac-tool

Command Line Examples (Standalone)

# Show which users/groups/service accounts are allowed to read secrets in the cluster pointed by kubeconfig
rbac-tool who-can get secrets

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list

kubectl rbac-tool ...

# Generate HTML visualzation of your RBAC permissions
kubectl rbac-tool viz

# Query who can read secrets
kubectl rbac-tool who-can get secret

# Generate a ClusterRole policy that allows to read everything except secrets and services
kubectl rbac-tool gen --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v1.1.3

19 Jul 11:42
@github-actions github-actions
v1.1.3
9c27b0c
Compare
Choose a tag to compare
v1.1.3

insightCloudSec | insightCloudSec | RBAC TOOL

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

Standalone

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

kubectl plugin // krew //

$ kubectl krew install rbac-tool

Command Line Examples (Standalone)

# Show which users/groups/service accounts are allowed to read secrets in the cluster pointed by kubeconfig
rbac-tool who-can get secrets

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list

kubectl rbac-tool ...

# Generate HTML visualzation of your RBAC permissions
kubectl rbac-tool viz

# Query who can read secrets
kubectl rbac-tool who-can get secret

# Generate a ClusterRole policy that allows to read everything except secrets and services
kubectl rbac-tool gen --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v1.1.2

19 Jul 11:13
@github-actions github-actions
v1.1.2
6c37b50
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.2

insightCloudSec | insightCloudSec | RBAC TOOL

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

Standalone

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

kubectl plugin // krew //

$ kubectl krew install rbac-tool

Command Line Examples (Standalone)

# Show which users/groups/service accounts are allowed to read secrets in the cluster pointed by kubeconfig
rbac-tool who-can get secrets

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list

kubectl rbac-tool ...

# Generate HTML visualzation of your RBAC permissions
kubectl rbac-tool viz

# Query who can read secrets
kubectl rbac-tool who-can get secret

# Generate a ClusterRole policy that allows to read everything except secrets and services
kubectl rbac-tool gen --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v1.1.1

11 Jul 22:35
@github-actions github-actions
v1.1.1
49af351
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.1

rbac-tool

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Show which users/groups/service accounts are allowed to read secrets in the cluster pointed by kubeconfig
rbac-tool who-can get secrets

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v1.1.0

28 Jun 11:30
@github-actions github-actions
v1.1.0
2e60c5f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.0

rbac-tool

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Show which users/groups/service accounts are allowed to read secrets in the cluster pointed by kubeconfig
rbac-tool who-can get secrets

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading
0 Join discussion

v1.0.0

30 May 07:38
@github-actions github-actions
v1.0.0
7710a34
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.0.0

rbac-tool

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v0.10.1

12 Oct 13:59
@github-actions github-actions
v0.10.1
70e8096
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.10.1

rbac-tool

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v0.10.0

17 Jul 10:10
@github-actions github-actions
v0.10.0
35e5db8
Compare
Choose a tag to compare
v0.10.0

rbac-tool

rbac-tool

Changes

  • Bug fixes
  • Visualize PodSecurityPolicy references (rbac-tool viz)

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading

v0.9.1

26 Jun 10:55
@github-actions github-actions
v0.9.1
29ea643
Compare
Choose a tag to compare
v0.9.1

rbac-tool

rbac-tool

A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity

Install

curl https://raw.githubusercontent.com/alcideio/rbac-tool/master/download.sh | bash

Command Line Examples

# Scan the cluster pointed by the kubeconfig context 'myctx'
rbac-tool viz --cluster-context myctx

# Scan and create a PNG image from the graph
rbac-tool viz --outformat dot --exclude-namespaces=soemns && cat rbac.dot | dot -Tpng > rbac.png && google-chrome rbac.png
# Render Online
https://dreampuf.github.io/GraphvizOnline

# Search All Service Accounts That Contains myname
rbac-tool lookup -e '.*myname.*'

# Lookup all accounts that DO NOT start with system: )
rbac-tool lookup -ne '^system:.*'

# List policy rules for users (or all of them)
rbac-tool policy-rules -e '^system:anonymous'

# Generate from Audit events & Visualize 
rbac-tool auditgen -f testdata  | rbac-tool viz   -f -

# Generate a `ClusterRole` policy that allows to read everything **except** *secrets* and *services*
rbac-tool  gen  --deny-resources=secrets.,services. --allowed-verbs=get,list
Loading