Skip to content

kube-chainsaw

Graph-level RBAC and NetworkPolicy analysis for Kubernetes manifests

Get Started GitHub

Demo

kube-chainsaw demo

How It Works

kube-chainsaw analyzes Kubernetes RBAC, workload security contexts, NetworkPolicy manifests, and OpenShift SCC assignments by building a directed graph of permissions and checking declared security posture.

graph LR
    subgraph Input
        A[YAML Manifests]
        A2[Live Cluster]
    end

    subgraph "kube-chainsaw"
        B[Loader] --> C[Graph Builder]
        C --> D[31 Detection Rules]
        D --> E[Severity Engine]
    end

    subgraph Output
        F[Console]
        G[JSON]
        H[SARIF 2.1.0]
    end

    A --> B
    A2 -->|kubectl| B
    E --> F
    E --> G
    E --> H

Pipeline:

  1. Loader parses YAML manifests from local files or fetches them from a live cluster via kubectl (RBAC resources, workloads, Services, Ingresses, NetworkPolicies, and optional OpenShift resources)
  2. Graph Builder maps SA -> Binding -> Role -> verb/resource permission chains
  3. 31 Detection Rules (KC-001 through KC-031) identify dangerous patterns, wildcards, escalation paths, broad NetworkPolicy peers, workload security issues, exposure, Secret, and OpenShift SCC risks
  4. Severity Engine adjusts RBAC severity by binding scope and assigns explicit posture severity to workloads, NetworkPolicies, and SCCs

Quick Example

Given a Kubernetes operator with overly permissive RBAC:

# roles.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-operator-role
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch", "create", "update"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings"]
    verbs: ["create", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-operator-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: my-operator-role
subjects:
  - kind: ServiceAccount
    name: my-operator-sa
    namespace: default

Run kube-chainsaw:

$ kube-chainsaw config/

=== HIGH ===

  [KC-006] Secrets access
    File:        config/roles.yaml
    Resource:    ClusterRole/my-operator-role
    Description: Role "my-operator-role" grants access to dangerous resource "secrets"
    Remediation: Restrict secrets access to specific namespaces and only the verbs needed

  [KC-010] RBAC modification capability
    File:        config/roles.yaml
    Resource:    ClusterRole/my-operator-role
    Description: Role "my-operator-role" grants access to dangerous resource "clusterrolebindings"
    Remediation: Limit RBAC modification to dedicated admin roles with proper audit

  [KC-011] Privilege escalation via role/binding modification
    File:        config/roles.yaml
    Resource:    ClusterRole/my-operator-role
    Description: Role "my-operator-role" can create/modify roles or bindings (privilege escalation risk)
    Remediation: Restrict ability to create/modify roles and bindings to admin users only

Total: 3 findings [3 HIGH]

Generate SARIF for GitHub Code Scanning:

kube-chainsaw config/ --format sarif --output results.sarif

Comparison

Tool Static Analysis Live Cluster Graph Traversal Privilege Chains Workload Analysis
kube-chainsaw ✅ ✅ ✅ ✅ ✅
kube-linter ✅ ❌ ❌ ❌ ❌
KubiScan ❌ ✅ ✅ ✅ ❌
rbac-tool ❌ ✅ ✅ ❌ ❌
kubectl-who-can ❌ ✅ ✅ ❌ ❌

kube-chainsaw performs graph traversal on YAML manifests or live clusters to detect privilege escalation chains. It works pre-deployment on static files or post-deployment via --from-cluster.

Features

  • Graph Traversal

    Builds SA -> Binding -> Role -> verb/resource permission graphs. Detects multi-hop privilege escalation paths that flat rule-based linters miss.

  • Static + Live Analysis

    Analyzes manifests before deployment or scans a live cluster via --from-cluster. Works in CI pipelines, local development, and production audits.

  • SARIF Output

    Native SARIF 2.1.0 for GitHub Code Scanning, GitLab SAST, and other security platforms. Includes fingerprints for deduplication.

  • CI-First Design

    Exit codes, machine-readable output, and suppression files designed for automated security gates in CI/CD pipelines.

What Gets Detected

31 detection rules covering:

Category Rules Examples
Wildcard permissions KC-001, KC-002 resources: ["*"], verbs: ["*"]
Dangerous verbs KC-003, KC-004, KC-005 escalate, impersonate, bind
Sensitive resources KC-006 to KC-010 secrets, pods/exec, nodes, PVs, clusterrolebindings
Escalation combos KC-011, KC-012 create/patch on roles/bindings, workload creation
Privilege chains KC-013, KC-014 cluster-admin pods, RoleBinding->ClusterRole
Aggregation KC-015 aggregated ClusterRoles
NetworkPolicy KC-016 to KC-018 NetworkPolicy access, broad ingress and egress peers
Workload security KC-019 to KC-022 privileged containers, host namespaces, hostPath, dangerous capabilities
OpenShift SCC KC-023 to KC-024 SCC use permissions and permissive assignments
Exposure KC-025 to KC-027 external Services, unencrypted routes, broad hosts
Secrets and certificate access KC-028 to KC-031 credential manifests, token Secrets, token minting, CSR approval

See Detection Rules for the full reference with YAML examples.

Next Steps