gcp-gke-rbac-exec-pod

id: gcp-gke-rbac-exec-pod
emits: CanExecuteCommand
description: "K8s RBAC pods/exec create (or ClusterRole containing it) on a namespace/cluster grants CanExecuteCommand\
  \ on pods in scope \u2014 the direct exec path independent of GCP IAM."
match_effective_permission:
  action: k8s:pods/exec create
  resource_type: k8s/Pod
where:
- ?principal holds pods/exec create (as a ClusterRole verb) via a ClusterRoleBinding or a RoleBinding
  in the pod's namespace
- ?pod is within the scope of the RBAC grant (namespace or cluster-wide)
emit:
  source_type: Identity
  target_type: KubernetesWorkload
  source: <principal>
  target: <pod / KubernetesWorkload in scope>
  permissions:
  - k8s:pods/exec create
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE if the ClusterRoleBinding or RoleBinding granting pods/exec create is confirmed
    and the pod is running. CONDITIONAL(service_state) if the pod is not currently running (exec requires
    a live container). BLOCKED if a PodSecurity admission controller, OPA/Gatekeeper, or Kyverno policy
    denies exec; emit BLOCKED with denied_by=<admission controller>.
  confidence: 0.95
  derived_from:
  - <RBAC ClusterRoleBinding / RoleBinding granting pods/exec create on ?pod>
  false_positive_note: "Scope the exec verb PRECISELY to the namespace and pod. A RoleBinding in namespace\
    \ A does not grant exec in namespace B. A ClusterRoleBinding with resourceNames restricts to specific\
    \ pods \u2014 honor it. Exec requires the pod to be Running; a Pending/Completed/CrashLoopBackOff\
    \ pod is CONDITIONAL(service_state). PodSecurity / admission webhooks may deny exec even if RBAC allows\
    \ it \u2014 emit BLOCKED when such a policy is detected."
  narrative: "{principal.name} holds pods/exec create (via ClusterRoleBinding / RoleBinding) on {pod.name},\
    \ allowing it to run arbitrary shell commands inside the running pod \u2014 equivalent to interactive\
    \ access to the container filesystem and any mounted credentials."