Kubernetes RBAC analyzer

Paste RBAC objects. See who is bound to what, where analysis is partial, and ask whether a subject is granted an action by the rules you supplied.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

RBAC objects

Opening local draft…

# Synthetic RBAC example
apiVersion: v1
kind: ServiceAccount
metadata:
  name: deployer
  namespace: ci
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-deployer
  namespace: shop
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployer-shop
  namespace: shop
subjects:
  - kind: ServiceAccount
    name: deployer
    namespace: ci
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: app-deployer
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring
aggregationRule:
  clusterRoleSelectors:
    - matchLabels:
        rbac.example.com/aggregate-to-monitoring: "true"
rules: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring-pods
  labels:
    rbac.example.com/aggregate-to-monitoring: "true"
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: monitoring
subjects:
  - kind: Group
    name: sre
    apiGroup: rbac.authorization.k8s.io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ops-admin
  namespace: shop
subjects:
  - kind: User
    name: alex@example.com
    apiGroup: rbac.authorization.k8s.io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: shop-operator

Check an action

Subject kindSubject nameSA namespaceVerbAPI groupResourcee.g. pods, pods/log, deploymentsNamespaceResource name

Allowed by supplied rules

Via RoleBinding/deployer-shop → Role/app-deployer (namespace shop): verbs [get, list] on [secrets] in groups [""]

Only the supplied bindings were evaluated. Default ClusterRoles, other bindings, group memberships (e.g. system:authenticated) and non-RBAC authorizers are not known.
Some roles are partial (aggregated or missing); see the partial-analysis list.

Partial analysis

ClusterRole/monitoring uses aggregationRule; only the 1 supplied matching ClusterRole(s) were merged. Other ClusterRoles in the cluster (including ones added later by operators) may add rules.
RoleBinding/ops-admin references ClusterRole/shop-operator, which is not supplied; its permissions are unknown.

Who is bound to what

Subject	Scope	Via	Rules
ServiceAccount deployer ns ci	namespace shop	RoleBinding/deployer-shop → Role/app-deployer	get,list,watch,update,patch apps/deployments get,list core/secrets
Group sre	cluster-wide	ClusterRoleBinding/monitoring → ClusterRole/monitoring	get,list,watch core/pods,pods/log aggregated: monitoring-pods
User alex@example.com	namespace shop	RoleBinding/ops-admin → ClusterRole/shop-operator	role not supplied

Permissions worth a second look

Role/app-deployer can read Secrets (list/watch expose every value in scope)

What "allowed" means here

Answers are phrased as "allowed by the supplied rules". The cluster may have other bindings, default ClusterRoles, group memberships such as system:authenticated, or other authorizers. Roles referenced but not supplied make the answer unknown rather than denied.

Aggregated ClusterRoles are filled in only from supplied ClusterRoles whose labels match. They are always marked partial, because controllers and operators can add matching roles at any time.

Questions

Can it read my cluster’s RBAC?

Not directly. Export the objects yourself, for example with kubectl get roles,rolebindings -A -o yaml, and paste them. Run the redaction tool first if the export contains secrets.

Which permissions are flagged as risky?

Wildcards, reading Secrets, escalate/bind/impersonate, pods/exec, and creating workloads. Creating workloads lets a subject mount any ServiceAccount or Secret in the namespace.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.