Awesome Open Source
Awesome Open Source



audit2rbac takes a Kubernetes audit log and username as input, and generates RBAC role and binding objects that cover all the API requests made by that user.

Demo Video

User Instructions

  1. Obtain a Kubernetes audit log containing all the API requests you expect your user to perform:

    • The log must be in JSON format. This requires running an API server with an --audit-policy-file defined. See documentation for more details.
    •, and events are supported.
    • The Metadata log level works best to minimize log size.
    • To exercise all API calls, it is sometimes necessary to grant broad access to a user or application to avoid short-circuiting code paths on failed API requests. This should be done cautiously, ideally in a development environment.
    • A sample audit policy and a sample audit log containing requests from alice, bob, and the service account ns1:sa1 is available.
  2. Identify a specific user you want to scan for audit events for and generate roles and role bindings for:

    • Specify a normal user with --user <username>
    • Specify a service account with --serviceaccount <namespace>:<name>
  3. Run audit2rbac, capturing the output:

    audit2rbac -f --user alice             > alice-roles.yaml
    audit2rbac -f --user bob               > bob-roles.yaml
    audit2rbac -f --serviceaccount ns1:sa1 > sa1-roles.yaml
  4. Inspect the output to verify the generated roles/bindings:

    more alice-roles.yaml
    kind: Role
      labels: "true" alice
      name: audit2rbac:alice
      namespace: ns1
    - apiGroups:
      - ""
      - configmaps
      - pods
      - secrets
      - get
      - list
      - watch
    kind: RoleBinding
      labels: "true" alice
      name: audit2rbac:alice
      namespace: ns1
      kind: Role
      name: audit2rbac:alice
    - apiGroup:
      kind: User
      name: alice
  5. Load the generated roles/bindings:

    kubectl create -f roles.yaml
    role "audit2rbac:alice" created
    rolebinding "audit2rbac:alice" created

Developer Instructions


  • Go 1.13.x

To build and install from source:

go get -d
cd $GOPATH/src/
git fetch --tags
make install-deps
make install

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
go (14,962
kubernetes (1,741
authorization (214
openshift (102
rbac (97
audit (77