OCI OKE Roles and ClusterRoles Should Avoid Wildcard Use

kubectl get clusterroles -o yaml | grep -n "verbs: \[\\"*\\\"\|resources: \[\\"*\\\"" -n

kubectl get clusterroles
kubectl get clusterrole <name> -o yaml

kubectl get roles -A
kubectl get role <name> -n <namespace> -o yaml

rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch"]

kubectl get clusterroles -o yaml | grep "\*"
kubectl get roles -A -o yaml | grep "\*"

# Variables
COMPARTMENT_OCID="<your_compartment_ocid>"
CLUSTER_OCID="<your_cluster_ocid>"
KUBECONFIG_FILE="$HOME/.kube/config-oke"

# Generate kubeconfig for the OKE cluster
oci ce cluster create-kubeconfig \
  --cluster-id "$CLUSTER_OCID" \
  --file "$KUBECONFIG_FILE" \
  --region <your_region> \
  --token-version 2.0.0 \
  --kube-endpoint PUBLIC_ENDPOINT  # or PRIVATE_ENDPOINT as applicable

# Point kubectl to this kubeconfig
export KUBECONFIG="$KUBECONFIG_FILE"

# Any ClusterRole that has verbs: ["*"]
kubectl get clusterrole -o json \
  | jq -r '.items[]
    | select(.rules[]? | (.verbs[]? == "*"))
    | .metadata.name'

# Any ClusterRole that has resources: ["*"]
kubectl get clusterrole -o json \
  | jq -r '.items[]
    | select(.rules[]? | (.resources[]? == "*"))
    | .metadata.name'

# Optional: inspect full definition of a specific role
kubectl get clusterrole <name> -o yaml

# All Roles in all namespaces that use verbs: ["*"]
kubectl get role -A -o json \
  | jq -r '.items[]
    | select(.rules[]? | (.verbs[]? == "*"))
    | "\(.metadata.namespace)/\(.metadata.name)"'

# All Roles in all namespaces that use resources: ["*"]
kubectl get role -A -o json \
  | jq -r '.items[]
    | select(.rules[]? | (.resources[]? == "*"))
    | "\(.metadata.namespace)/\(.metadata.name)"'

# ClusterRoles
kubectl get clusterrole -o json \
  | jq -e '.items[]
    | select(.rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*"))' \
  >/dev/null && echo "Still have wildcard ClusterRoles" || echo "No wildcard ClusterRoles"

# Roles
kubectl get role -A -o json \
  | jq -e '.items[]
    | select(.rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*"))' \
  >/dev/null && echo "Still have wildcard Roles" || echo "No wildcard Roles"

pip install kubernetes pyyaml

export KUBECONFIG=/path/to/oke-kubeconfig
kubectl get nodes

from kubernetes import client, config

# Load kubeconfig from default location or explicit path
config.load_kube_config()  # or config.load_kube_config(config_file="path/to/kubeconfig")

rbac_api = client.RbacAuthorizationV1Api()

def has_wildcard(rule):
    # Detect if rule has wildcard in verbs, resources or apiGroups
    return (
        any(v == "*" for v in (rule.verbs or [])) or
        any(r == "*" for r in (rule.resources or [])) or
        any(ag == "*" for ag in (rule.api_groups or []))
    )

def find_wildcard_roles():
    bad_roles = []
    bad_clusterroles = []

    # Namespaced Roles
    roles = rbac_api.list_role_for_all_namespaces().items
    for role in roles:
        bad_rules = [r for r in role.rules or [] if has_wildcard(r)]
        if bad_rules:
            bad_roles.append((role, bad_rules))

    # ClusterRoles
    clusterroles = rbac_api.list_cluster_role().items
    for cr in clusterroles:
        bad_rules = [r for r in cr.rules or [] if has_wildcard(r)]
        if bad_rules:
            bad_clusterroles.append((cr, bad_rules))

    return bad_roles, bad_clusterroles

bad_roles, bad_clusterroles = find_wildcard_roles()

print("Roles with wildcard rules:")
for role, rules in bad_roles:
    print(f"  Role: {role.metadata.namespace}/{role.metadata.name}")
print("ClusterRoles with wildcard rules:")
for cr, rules in bad_clusterroles:
    print(f"  ClusterRole: {cr.metadata.name}")

# Example mapping – adjust to your environment and security policy
VERB_REPLACEMENTS = {
    "*": ["get", "list", "watch"]  # Or full CRUD set: ["get","list","watch","create","update","patch","delete"]
}

RESOURCE_REPLACEMENTS = {
    "*": [
        "pods", "pods/log",
        "deployments", "replicasets", "statefulsets",
        "services", "configmaps", "secrets"
        # Add only what is really required
    ]
}

API_GROUP_REPLACEMENTS = {
    "*": ["", "apps", "batch"]  # Core group is ""; add only needed groups
}

from copy import deepcopy

def replace_wildcards_in_rule(rule):
    new_rule = deepcopy(rule)

    # Replace verbs
    new_verbs = []
    for v in rule.verbs or []:
        if v == "*" and "*" in VERB_REPLACEMENTS:
            new_verbs.extend(VERB_REPLACEMENTS["*"])
        else:
            new_verbs.append(v)
    new_rule.verbs = list(sorted(set(new_verbs)))

    # Replace resources
    new_resources = []
    for r in rule.resources or []:
        if r == "*" and "*" in RESOURCE_REPLACEMENTS:
            new_resources.extend(RESOURCE_REPLACEMENTS["*"])
        else:
            new_resources.append(r)
    new_rule.resources = list(sorted(set(new_resources)))

    # Replace apiGroups
    new_api_groups = []
    for ag in rule.api_groups or []:
        if ag == "*" and "*" in API_GROUP_REPLACEMENTS:
            new_api_groups.extend(API_GROUP_REPLACEMENTS["*"])
        else:
            new_api_groups.append(ag)
    new_rule.api_groups = list(sorted(set(new_api_groups)))

    return new_rule

def sanitize_role(role_obj):
    new_role = deepcopy(role_obj)
    new_rules = []

    for r in role_obj.rules or []:
        if has_wildcard(r):
            new_rules.append(replace_wildcards_in_rule(r))
        else:
            new_rules.append(r)

    new_role.rules = new_rules
    return new_role


def sanitize_clusterrole(cr_obj):
    new_cr = deepcopy(cr_obj)
    new_rules = []

    for r in cr_obj.rules or []:
        if has_wildcard(r):
            new_rules.append(replace_wildcards_in_rule(r))
        else:
            new_rules.append(r)

    new_cr.rules = new_rules
    return new_cr

import yaml
from pathlib import Path

backup_dir = Path("./rbac-backup")
backup_dir.mkdir(exist_ok=True)

def backup_obj(obj, kind):
    ns = getattr(obj.metadata, "namespace", None)
    name = obj.metadata.name
    file_name = f"{kind}_{ns+'_' if ns else ''}{name}.yaml"
    with open(backup_dir / file_name, "w") as f:
        yaml.safe_dump(client.ApiClient().sanitize_for_serialization(obj), f)

for role, _ in bad_roles:
    backup_obj(role, "Role")

for cr, _ in bad_clusterroles:
    backup_obj(cr, "ClusterRole")

# Sanitize and apply Roles
for role, _ in bad_roles:
    ns = role.metadata.namespace
    name = role.metadata.name
    updated_role = sanitize_role(role)
    print(f"Updating Role {ns}/{name}")
    rbac_api.replace_namespaced_role(
        name=name,
        namespace=ns,
        body=updated_role
    )

# Sanitize and apply ClusterRoles
for cr, _ in bad_clusterroles:
    name = cr.metadata.name
    updated_cr = sanitize_clusterrole(cr)
    print(f"Updating ClusterRole {name}")
    rbac_api.replace_cluster_role(
        name=name,
        body=updated_cr
    )

kubectl get roles -A -o yaml | grep -n "\*" || echo "No wildcards in Roles"
kubectl get clusterroles -o yaml | grep -n "\*" || echo "No wildcards in ClusterRoles"

# This finding cannot be remediated on the OCI OKE *cluster* resource itself.
# Kubernetes RBAC (Roles/ClusterRoles) is managed via the Kubernetes API,
# so you must use the Kubernetes provider (or Helm) rather than
# `oci_containerengine_cluster` / `oci-containers-oke-cluster`.

provider "kubernetes" {
  host                   = var.CLUSTER_ENDPOINT          # OKE API server endpoint
  cluster_ca_certificate = base64decode(var.CLUSTER_CA)  # OKE cluster CA cert
  token                  = var.BEARER_TOKEN              # Or use exec/auth-provider as appropriate
}

# Example of a Role that previously used wildcards:
#   verbs = ["*"]
#   resources = ["*"]
# Replace wildcards with explicit verbs and resources.

resource "kubernetes_role" "app_namespace_reader" {
  metadata {
    name      = "APP_ROLE_NAME"        # e.g. "app-namespace-reader"
    namespace = "TARGET_NAMESPACE"     # e.g. "app-namespace"
  }

  rule {
    api_groups = [""]
    resources  = ["pods", "services", "configmaps"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = [""]
    resources  = ["secrets"]
    verbs      = ["get"]               # no list/watch to reduce exposure
  }
}

# Example of a ClusterRole that previously used wildcards:
#   verbs = ["*"]
#   resources = ["*"]
# Again, enumerate exactly what is required.

resource "kubernetes_cluster_role" "cluster_reader_limited" {
  metadata {
    name = "CLUSTER_ROLE_NAME"         # e.g. "cluster-reader-limited"
  }

  rule {
    api_groups = [""]
    resources  = ["nodes", "pods", "namespaces"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = ["apps"]
    resources  = ["deployments", "statefulsets", "daemonsets", "replicasets"]
    verbs      = ["get", "list", "watch"]
  }
}

# Optionally bind these to service accounts/users instead of
# any broad existing bindings that assume wildcard permissions.

resource "kubernetes_role_binding" "app_namespace_reader_bind" {
  metadata {
    name      = "APP_ROLE_BINDING_NAME"  # e.g. "app-namespace-reader-binding"
    namespace = "TARGET_NAMESPACE"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = kubernetes_role.app_namespace_reader.metadata[0].name
  }

  subject {
    kind      = "ServiceAccount"
    name      = "TARGET_SERVICE_ACCOUNT" # e.g. "app-sa"
    namespace = "TARGET_NAMESPACE"
  }
}

resource "kubernetes_cluster_role_binding" "cluster_reader_limited_bind" {
  metadata {
    name = "CLUSTER_ROLE_BINDING_NAME"   # e.g. "cluster-reader-limited-binding"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.cluster_reader_limited.metadata[0].name
  }

  subject {
    kind      = "User"
    name      = "TARGET_USER_OR_OIDC_SUBJECT"
    api_group = "rbac.authorization.k8s.io"
  }
}