Autogenerate RBAC policies based on Kubernetes audit logs
Clone or download
Latest commit 865d3ea Aug 15, 2018



audit2rbac takes a Kubernetes audit log and username as input, and generates RBAC role and binding objects that cover all the API requests made by that user.

Demo Video

User Instructions

  1. Obtain a Kubernetes audit log containing all the API requests you expect your user to perform:

    • The log must be in JSON format. This requires running an API server with --feature-gates=AdvancedAudit=true and an --audit-policy-file defined. See documentation for more details.
    • v1alpha1 or v1beta1 audit events are supported.
    • The Metadata log level works best to minimize log size.
    • To exercise all API calls, it is sometimes necessary to grant broad access to a user or application to avoid short-circuiting code paths on failed API requests. This should be done cautiously, ideally in a development environment.
    • A sample audit policy and a sample audit log containing requests from alice, bob, and the service account ns1:sa1 is available.
  2. Identify a specific user you want to scan for audit events for and generate roles and role bindings for:

    • Specify a normal user with --user <username>
    • Specify a service account with --serviceaccount <namespace>:<name>
  3. Run audit2rbac, capturing the output:

    audit2rbac -f --user alice             > alice-roles.yaml
    audit2rbac -f --user bob               > bob-roles.yaml
    audit2rbac -f --serviceaccount ns1:sa1 > sa1-roles.yaml
  4. Inspect the output to verify the generated roles/bindings:

    more alice-roles.yaml
    kind: Role
      labels: "true" alice
      name: audit2rbac:alice
      namespace: ns1
    - apiGroups:
      - ""
      - configmaps
      - pods
      - secrets
      - get
      - list
      - watch
    kind: RoleBinding
      labels: "true" alice
      name: audit2rbac:alice
      namespace: ns1
      kind: Role
      name: audit2rbac:alice
    - apiGroup:
      kind: User
      name: alice
  5. Load the generated roles/bindings:

    kubectl create -f roles.yaml
    role "audit2rbac:alice" created
    rolebinding "audit2rbac:alice" created

Developer Instructions


  • Go 1.9.x
  • Glide 0.13.1+

To build and install from source:

go get -d
cd $GOPATH/src/
git fetch --tags
make install-deps
make install