Kubernetes Role Binding Modification in Production Namespace

Danny Y@zendannyy

•updated Feb 22, 2026•1•0•95

Rule to detect where there are role bindings and high-risk actions (verbs) applied within production or default namespaces. This rule specifically looks for these high-risk actions (verbs), excluding actions by the 'system:clusterrole-aggregation-controller' user, which is a legitimate system process.