You might want information about Kubernetes ClusterRoles and ClusterRoleBindings, which have elevated namespace and cluster permissions, when doing the following:
Prerequisites
In order to execute this procedure in your environment, you may need to first on-board the services or apps shown in the following table.
|
Category |
Name |
Importance |
|
Service |
Kubernetes |
Required |
|
Add-on |
Required |
|
|
App |
Required |
|
|
Add-on |
Required |
|
|
Add-on |
Required |
Example
The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source.
Sensitive role resource access is necessary for cluster operation, however, you want to make sure roles with permission to sensitive objects aren't using their privileges for malicious ends. You want to investigate sensitive roles on your network to determine if they represent a threat.
AWS
- Ensure that your deployment is ingesting CloudWatch logs.
- Run the following search:
`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrolebindings sourceIPs{}!=::1 sourceIPs{}!=<valid IP address>
|table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason
|dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_role_access_filter`
Search Explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|
Splunk Search |
Explanation |
|
`aws_cloudwatchlogs_eks` |
Run a macro to search AWS EKS Kubernetes data. Note: The punctuation surrounding a Splunk macro is always a back tick (`), not a single quote ('). |
|
objectRef.resource=clusterroles OR clusterrolebindings |
Search for events from the sensitive roles, clusterrole or clusterrolebindings. |
|
sourceIPs{}!=::1 |
Exclude a legitimate IP address or range of addresses from the search. |
|
|table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason |
Display the results in a table with columns in the order shown. |
|
|dedup user.username user.groups{} |
Remove duplicate results from the same IPs and users. |
|
|`kubernetes_aws_detect_sensitive_role_access_filter` |
Run this macro to speed up the search. |
Azure
- Ensure that you have configured Kube-Audit data diagnostics.
- Run the following search:
`kubernetes_azure` category=kube-audit
|spath input=properties.log
|search objectRef.resource=clusterroles OR clusterrolebindings
|table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason
|dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`
Search Explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|
Splunk Search |
Explanation |
|
`kubernetes_azure` |
Run a macro to search Azure Kubernetes data. Note: The punctuation surrounding a Splunk macro is always a back tick (`), not a single quote ('). |
|
category=kube-audit |
Search the data source kube-audit from the diagnostic logs in Azure Cloud services. |
|
|spath input=properties.log |
Extract fields from the properties Kube-Audit log. |
|
|search objectRef.resource=clusterroles OR clusterrolebindings |
Search for events from the sensitive roles, clusterrole or clusterrolebindings. |
|
|table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason |
Display the results in a table with columns in the order shown. |
|
|dedup user.username user.groups{} |
Remove duplicate results from the same IPs and users. |
|
|`kubernetes_azure_detect_sensitive_role_access_filter` |
Run this macro to speed up the search. |
GCP
- Ensure that your deployment is ingesting Pub/Sub messaging logs.
- Run the following search:
`google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole dest=apis/rbac.authorization.k8s.io/v1 src_ip!=::1
|table src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason
|dedup src_ip src_user |`kubernetes_gcp_detect_sensitive_role_access_filter`
Search Explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
|
Splunk Search |
Explanation |
|
`google_gcp_pubsub_message` |
Run a macro to search GCP Pub/Sub Kubernetes data. Note: The punctuation surrounding a Splunk macro is always a back tick (`), not a single quote ('). |
|
data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole |
Search for events from the sensitive roles, clusterrole or clusterrolebindings. |
|
dest=apis/rbac.authorization.k8s.io/v1 |
Search events with this destination path. |
|
src_ip!=::1 |
Exclude a legitimate range of addresses from the search. |
|
|table src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason |
Display the results in a table with columns in the order shown. |
|
|dedup src_ip src_user |
Remove duplicate results from the same IPs and users. |
|
|`kubernetes_gcp_detect_sensitive_role_access_filter` |
Run this macro to speed up the search. |
Result
If any of the following appear in your results, you should investigate further:
- Unknown IP addresses
- Unauthenticated or unknown usergroups that request access to sensitive roles
- Unusual geographical location, access times, or reasons
Comments
0 comments
Please sign in to leave a comment.