risky_roles.yaml

######################### REGION - Risky permissions combinations #########################

# The order is important !

######################### REGION - CRITICAL Roles #########################

# Risk: Viewing specific secrets
# Verb: get
# Resources: secrets
# Example: kubectl get secrets <secret_name>

items:

- kind: Role
  metadata:
    namespace: default
    name: risky-get-secrets
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["secrets"]
    verbs: ["get"]

# Risk: Viewing all secrets
# Verb: list
# Resources: secrets
# Example: kubectl get secrets -o yaml

- kind: Role
  metadata:
    namespace: default
    name: risky-list-secrets
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["secrets"]
    verbs: ["list"]

# Risk: Impersonate privileged groups (like "system:masters")
# Verb: list
# Resources: secrets
# Example: kubectl get secrets -o yaml
- kind: Role
  metadata:
    namespace: default
    name: risky-impersonate-groups
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["groups"]
    verbs: ["impersonate"]

######################### REGION - Any Any Roles #########################

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

######################### END REGION - Any Any Roles #########################

######################### REGION - Any verb Roles #########################

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-secrets
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["secrets"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-pods
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["pods"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-deployments
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["deployments"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-daemonsets
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["daemonsets"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-statefulsets
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["statefulsets"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-replicationcontrollers
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["replicationcontrollers"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-replicasets
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["replicasets"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-cronjobs
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["cronjobs"]
    verbs: ["*"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-jobs
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["jobs"]
    verbs: ["*"]

  - kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-roles
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["roles"]
    verbs: ["*"]

  - kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-clusterroles
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["clusterroles"]
    verbs: ["*"]

  - kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-rolebindings
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["rolebindings"]
    verbs: ["*"]

  - kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-clusterrolebindings
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["clusterrolebindings"]
    verbs: ["*"]

  - kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-users
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["users"]
    verbs: ["*"]

  - kind: Role
  metadata:
    namespace: default
    name: risky-any-verb-groups
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["groups"]
    verbs: ["*"]

######################### END REGION - Any verb Roles #########################


######################### REGION - Any resource Roles #########################
- kind: Role
  metadata:
    namespace: default
    name: risky-any-resource-delete
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["delete"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-resource-delete
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["deletecollection"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-resource-create
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["create"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-resource-list
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["list"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-resource-get
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get"]

- kind: Role
  metadata:
    namespace: default
    name: risky-any-resource-impersonate
    priority: CRITICAL
  rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["impersonate"]

######################### END REGION - Any resource Roles #########################


######################### END REGION - CRITICAL Roles #########################

######################### REGION - HIGH Roles #########################

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: deployments

- kind: Role
  metadata:
    namespace: default
    name: risky-create-deployments
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["deployments"]
    verbs: ["create"]

# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: deployments

- kind: Role
  metadata:
    namespace: default
    name: risky-update-deployments
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["deployments"]
    verbs: ["update"]

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: daemonsets

- kind: Role
  metadata:
    namespace: default
    name: risky-create-daemonsets
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["daemonsets"]
    verbs: ["create"]

# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: daemonsets

- kind: Role
  metadata:
    namespace: default
    name: risky-update-daemonsets
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["daemonsets"]
    verbs: ["update"]

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: statefulsets

- kind: Role
  metadata:
    namespace: default
    name: risky-create-statefulsets
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["statefulsets"]
    verbs: ["create"]

# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: statefulsets

- kind: Role
  metadata:
    namespace: default
    name: risky-update-statefulsets
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["statefulsets"]
    verbs: ["update"]

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: replicationcontrollers

- kind: Role
  metadata:
    namespace: default
    name: risky-create-replicationcontrollers
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["replicationcontrollers"]
    verbs: ["create"]

# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: replicationcontrollers

- kind: Role
  metadata:
    namespace: default
    name: risky-update-replicationcontrollers
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["replicationcontrollers"]
    verbs: ["update"]

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: replicasets

- kind: Role
  metadata:
    namespace: default
    name: risky-create-replicasets
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["replicasets"]
    verbs: ["create"]

# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: replicasets

- kind: Role
  metadata:
    namespace: default
    name: risky-update-replicasets
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["replicasets"]
    verbs: ["update"]

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: jobs

- kind: Role
  metadata:
    namespace: default
    name: risky-create-jobs
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["jobs"]
    verbs: ["create"]


# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: jobs

- kind: Role
  metadata:
    namespace: default
    name: risky-update-jobs
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["jobs"]
    verbs: ["update"]

# Risk: Allowing to create a malicious pod
# Verb: create
# Resources: cronjobs

- kind: Role
  metadata:
    namespace: default
    name: risky-create-jobs
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["cronjobs"]
    verbs: ["create"]


# Risk: Allowing to update a malicious pod
# Verb: update
# Resources: cronjobs

- kind: Role
  metadata:
    namespace: default
    name: risky-update-jobs
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["cronjobs"]
    verbs: ["update"]

# Risk: Allowing creation of rolebinding and associate privileged role to itself
#   GroupA:
#       Verb: create
#       Resource: rolebindings
#   GroupB:
#       Verb: bind
#       Resource: roles
#       resourceNames: privilegedRoles

- kind: Role
  metadata:
    namespace: default
    name: risky-create-rolebinding-role
    priority: HIGH
  rules:
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["rolebindings"]
    verbs: ["create"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles"]
    verbs: ["bind"]
    resourceNames: ["*"]

# Risk: Allowing creation of rolebinding and associate privileged clusterrole to itself
#   GroupA:
#       Verb: create
#       Resource: rolebindings
#   GroupB:
#       Verb: bind
#       Resource: clusterroles
#       resourceNames: privilegedRoles


- kind: Role
  metadata:
    namespace: default
    name: risky-create-rolebinding-clusterrole
    priority: HIGH
  rules:
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["rolebindings"]
    verbs: ["create"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles"]
    verbs: ["bind"]
    resourceNames: ["*"]

# Risk: Allowing creation of clusterrolebinding and associate privileged clusterrole to itself
#   GroupA:
#       Verb: create
#       Resource: clusterrolebinding
#   GroupB:
#       Verb: bind
#       Resource: clusterroles
#       resourceNames: privilegedRoles


- kind: Role
  metadata:
    namespace: default
    name: risky-create-clusterrolebinding-clusterrole
    priority: HIGH
  rules:
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings"]
    verbs: ["create"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterroles"]
    verbs: ["bind"]
    resourceNames: ["*"]

# Risk: Allowing update of a malicious pod
# Verb: create
# Resources: pods
# Example: kubectl create -f malicious-pod.yaml

- kind: Role
  metadata:
    namespace: default
    name: risky-create-pod
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["pods"]
    verbs: ["create"]


# Risk: Getting shell on pods
#   GroupA:
#       Verb: create
#       Resource: pods/exec
#   GroupB:
#       Verb: get
#       Resource: pods
# Example: kubectl exec podname -it sh

- kind: Role
  metadata:
    namespace: default
    name: risky-exec-pods
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: ["*"]
    resources: ["pods"]
    verbs: ["get"]


# Risk: Attaching pod and view all its logs in realtime
#   GroupA:
#       Verb: create
#       Resource: pods/attach
#   GroupB:
#       Verb: get
#       Resource: pods
# Example: kubectl attach podname -it sh


- kind: Role
  metadata:
    namespace: default
    name: risky-attach-pods
    priority: HIGH
  rules:
  - apiGroups: ["*"]
    resources: ["pods/attach"]
    verbs: ["create"]
  - apiGroups: ["*"]
    resources: ["pods"]
    verbs: ["get"]



######################### END REGION - HIGH Roles #########################

######################### REGION - LOW Roles #########################

# Risk: Allowing users in a rolebinding to add other users to their rolebindings
# Verb: get, patch
# Resources: rolebindings

- kind: Role
  metadata:
    namespace: default
    name: risky-add-rolebinding
    priority: LOW
  rules:
  - apiGroups: ["*"]
    resources: ["rolebindings"]
    verbs: ["get", "patch"]

######################### END REGION - LOW Roles #########################

######################### END REGION - Risky permissions combinations #########################