Detection Rules
kube-chainsaw implements 31 static analysis rules to detect RBAC misconfigurations, privilege escalation paths, broad NetworkPolicy peers, dangerous workload settings, external exposure, credential manifests, and OpenShift SCC risks.
Rule Groups
Browse rules by security area:
Full Rule Index
RBAC and Privileges
| Rule |
Description |
| KC-001 |
Wildcard resource or API group access in Role/ClusterRole |
| KC-002 |
Wildcard verb access in Role/ClusterRole |
| KC-003 |
escalate verb permission |
| KC-004 |
impersonate verb permission |
| KC-005 |
bind verb permission |
| KC-006 |
Access to core secrets resources |
| KC-007 |
Access to pods/exec, pods/attach, pods/log, pods/ephemeralcontainers |
| KC-008 |
Access to nodes or nodes/proxy |
| KC-009 |
Access to persistentvolumes |
| KC-010 |
Access to clusterroles or clusterrolebindings |
| KC-011 |
Mutation verbs on RBAC resources |
| KC-012 |
Create permission on workload resources |
| KC-013 |
Pod ServiceAccount bound to cluster-admin |
| KC-014 |
RoleBinding referencing a ClusterRole |
| KC-015 |
ClusterRole using aggregationRule |
Network and Exposure
| Rule |
Description |
| KC-016 |
RBAC access to networkpolicies |
| KC-017 |
Ingress rules with broad or missing peers |
| KC-018 |
Egress rules with broad or missing destinations |
| KC-025 |
LoadBalancer, NodePort, ExternalName, or externalIPs |
| KC-026 |
Ingress or Route without TLS |
| KC-027 |
Catch-all, wildcard, or subdomain routing |
Workloads and OpenShift
| Rule |
Description |
| KC-019 |
securityContext.privileged: true |
| KC-020 |
hostNetwork, hostPID, or hostIPC |
| KC-021 |
hostPath volumes |
| KC-022 |
Dangerous added Linux capabilities |
| KC-023 |
RBAC use permission on SCCs |
| KC-024 |
Permissive SCC assigned to broad subjects |
Secrets and Certificates
| Rule |
Description |
| KC-028 |
Credential-bearing Secret manifests |
| KC-029 |
Long-lived ServiceAccount token Secrets |
| KC-030 |
RBAC access to serviceaccounts/token |
| KC-031 |
CSR approval or signing permission |
Rule Severity Model
Finding severity is dynamic, based on how the role is bound:
| Condition |
Severity |
| Cluster-wide binding with wildcards |
CRITICAL |
| Cluster-wide binding without wildcards |
HIGH |
| Namespace-scoped binding with wildcards |
HIGH |
| Namespace-scoped binding without wildcards |
WARNING |
| Unbound role (no binding found) |
INFO |
Namespace-scoped Roles are capped at WARNING regardless of binding scope.
Special cases:
- KC-013 (cluster-admin pod) is always CRITICAL
- KC-014 (RoleBinding to ClusterRole) is always WARNING
- KC-015 (aggregated ClusterRole) is always INFO
- KC-017 and KC-018 are HIGH when the policy selects all pods in its namespace, otherwise WARNING
- KC-019 and KC-020 are always HIGH
- KC-021 and KC-022 are HIGH only for sensitive paths or high-risk capabilities, otherwise WARNING
- KC-024 is HIGH for broad SCC subjects, otherwise WARNING
- KC-025 and KC-027 are WARNING
- KC-026 is HIGH for insecureEdgeTerminationPolicy: Allow, otherwise WARNING
- KC-028 is WARNING and KC-029 is HIGH
Next Steps