What problem does it solve? Kubernetes permissions in this repository live in four places—kubebuilder RBAC markers, roles the operator builds in Go, hand-written chart roles and bindings, and workload security contexts—and most tooling audits only the first, leaving cluster-wide escalation primitives like pods/exec unexamined. ## Core Features & Use Cases - Four-source RBAC audit: The check-rbac.py script scans kubebuilder markers, Go-built roles, chart YAML, and workload security contexts, classifying findings against a severity-ranked list of escalation primitives (escalate, bind, impersonate, pods/exec, secret read, wildcard verbs). - Justification workflow: Reviewed grants carry an rbac-justified note stating what needs the permission, so audits distinguish deliberate decisions from unexamined surface, with --unjustified and --severity filters for triage. - Hardening guidance: Reference documents catalog which privileges the NVMe-oF data path genuinely requires (privileged CSI node plugin, host paths) versus sidecars that need none, plus the narrowest-scope-first ladder for any new grant. - Use Case: When adding a kubebuilder RBAC marker or a privileged container, run the checker with --changed to confirm nothing critical or high was introduced without justification before handing the change back. ## Quick Start Ask the AI to audit the repository's Kubernetes RBAC grants and security contexts for unjustified privilege escalation primitives using the rbac-hardening skill.
