Open engineering project · Undated read-only snapshot
A Go security analyzer that composes Kubernetes permissions and workload trust into reviewable paths, showing how individually legitimate grants can combine into a higher-risk capability without attempting exploitation.
A Role review can miss the path formed by bindings, aggregated roles, ServiceAccounts, impersonation, workload mutation, GitOps, CI/CD, admission, and infrastructure controllers. The risk is in composition, not always in one obviously broad rule.
The analyzer calculates effective permissions from roles, bindings, aggregation, wildcards, and special verbs, then relates identities to workloads, ServiceAccounts, and Secret references without reading values. Bounded graph traversal connects those grants with optional controller and delivery relationships, producing confidence, blast-radius context, existing controls, and least-privilege remediation for review.
Security review can discuss a concrete chain—identity, grant, capability, and consequence—without impersonating a user, executing a pod, mutating a workload, or claiming that a possible path was exercised.
The analyzer treats permission composition as an engineering problem through explainable graph analysis, conservative security boundaries, and remediation that can be reviewed before a policy change.
Typed RBAC discovery and dynamic integrations feed an effective-permission model, identity/workload relationships, bounded graph traversal, risk scoring, remediation, and text/JSON/diagram renderers.
The analyzer calculates effective permissions from roles, bindings, aggregation, wildcards, and special verbs, then relates identities to workloads, ServiceAccounts, and Secret references without reading values. Bounded graph traversal connects those grants with optional controller and delivery relationships, producing confidence, blast-radius context, existing controls, and least-privilege remediation for review.
The tool reasons from metadata and authorization rules; it does not impersonate identities, execute workloads, mutate objects, or read Secret values. This choice sacrifices runtime proof in exchange for a narrower permission set and an assessment that can be reviewed without exercising the access paths it describes.
Depth and path limits keep reports small enough for a person to inspect and make repeated runs comparable. A bounded walk can miss an unusually long escalation chain, so the configured limits and any truncation are reported as confidence constraints rather than hidden implementation details.
Native RBAC objects use typed clients, while optional GitOps, CI/CD, admission, and controller relationships are discovered dynamically. That combination retains compiler help for the authorization core while allowing broader relationship coverage without making every third-party integration a hard dependency or a prerequisite for useful output.
Kubernetes objects can show that a group is bound to a role, but they cannot prove who belongs to that identity-provider group. The analyzer preserves that boundary explicitly, preventing an unobservable external fact from being promoted into a definitive user-level security conclusion or remediation order.
The analyzer reasons from authorization metadata without impersonation, exec, mutation, workload creation, or Secret-value reads.
Workload and Secret references can contribute graph edges, but the values behind those references are never collected for the published analysis.
Depth limits, path limits, optional integrations, and unknown external group membership are reported as confidence constraints rather than hidden behind a definitive compromise claim.
identity-bf658e → granted-by → node-f0e179 → can → node-4024fd
Category: cluster administration
Severity: Critical
Required access: compromise or control of the source identity
Remediation: replace the broad binding with a narrowly scoped role.Checks shown here are project-specific; no portfolio-wide claim is applied automatically.
Links are limited to public-safe source material and sanitized evidence. Credentials, state, plans, identifiers, private topology, and backup contents are intentionally excluded.
Identity, RBAC, workload, cloud, and publication boundaries.
A visual map of the relevant trust boundaries.
Add explainable policy-diff mode that compares proposed RBAC manifests with current effective privilege paths before merge.
