No user or group can approve certificate signing requests

Check ID: rbac_minimize_csr_approval_access
Provider: Kubernetes
Service: rbac
Severity: HIGH
Categories: identity-access, cluster-security
Resource type: ClusterRoleBinding

What this check verifies

RBAC assignments that grant update or patch on the certificatesigningrequests/approval subresource to users or groups via cluster-wide roles and bindings. This highlights principals allowed to approve CSRs based on permissions defined in referenced ClusterRoles.

Risk

Excess CSR approval rights enable privilege escalation. A malicious user can approve CSRs to mint client certificates for arbitrary identities, gaining unauthorized API access, impersonating system components, and enabling data exfiltration and tampering, harming confidentiality and integrity.

Recommendation

Apply least privilege: allow CSR approval only to a small, trusted approver role.

Enforce separation of duties between CSR creation and approval
Prefer automated approver controllers over manual grants
Regularly review RBAC and remove broad ClusterRoleBindings
Use defense in depth with auditing and short-lived credentials

Remediation

CLI
Terraform
Dashboard steps

kubectl delete clusterrolebinding <example_resource_name>

resource "kubernetes_cluster_role" "safe" {
  metadata { name = "<example_resource_name>" }
  # No rules included -> ensures no update/patch on certificatesigningrequests/approval
}

resource "kubernetes_cluster_role_binding" "safe_bind" {
  metadata { name = "<example_resource_name>" }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.safe.metadata[0].name  # Critical: binds subject to a role without CSR approval rights
  }
  subject {
    kind      = "User"  # Use "Group" if binding a group
    name      = "<example_user_or_group>"
    api_group = "rbac.authorization.k8s.io"
  }
}

References

https://kubernetes.io/docs/concepts/security/rbac-good-practices/#csrs-and-certificate-issuing

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_csr_approval_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Cluster role binding does not grant the cluster-admin role No user or group can read the nodes/proxy sub-resource

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires