Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?



audit2rbac takes a Kubernetes audit log and username as input, and generates RBAC role and binding objects that cover all the API requests made by that user.

Demo Video

User Instructions

  1. Obtain a Kubernetes audit log containing all the API requests you expect your user to perform:

    • The log must be in JSON format. This requires running an API server with an --audit-policy-file defined. See documentation for more details.
    •, and events are supported.
    • The Metadata log level works best to minimize log size.
    • To exercise all API calls, it is sometimes necessary to grant broad access to a user or application to avoid short-circuiting code paths on failed API requests. This should be done cautiously, ideally in a development environment.
    • A sample audit policy and a sample audit log containing requests from alice, bob, and the service account ns1:sa1 is available.
  2. Identify a specific user you want to scan for audit events for and generate roles and role bindings for:

    • Specify a normal user with --user <username>
    • Specify a service account with --serviceaccount <namespace>:<name>
  3. Run audit2rbac, capturing the output:

    audit2rbac -f --user alice             > alice-roles.yaml
    audit2rbac -f --user bob               > bob-roles.yaml
    audit2rbac -f --serviceaccount ns1:sa1 > sa1-roles.yaml
  4. Inspect the output to verify the generated roles/bindings:

    more alice-roles.yaml
    kind: Role
      labels: "true" alice
      name: audit2rbac:alice
      namespace: ns1
    - apiGroups:
      - ""
      - configmaps
      - pods
      - secrets
      - get
      - list
      - watch
    kind: RoleBinding
      labels: "true" alice
      name: audit2rbac:alice
      namespace: ns1
      kind: Role
      name: audit2rbac:alice
    - apiGroup:
      kind: User
      name: alice
  5. Load the generated roles/bindings:

    kubectl create -f roles.yaml
    role "audit2rbac:alice" created
    rolebinding "audit2rbac:alice" created

Developer Instructions


  • Go 1.17+

To build and install from source:

go get -d
cd $GOPATH/src/
git fetch --tags
make install-deps
make install