I finally wrapped up a project that had been on my mind for over a year.

Introducing RBAC ATLAS - 🔗 https://rbac-atlas.github.io

RBAC ATLAS is a curated database of identities and the Role-Based Access Control (RBAC) policies tied to them in popular Kubernetes open-source projects. Each entry includes security annotations that highlight granted permissions, potential risks, and possible abuse scenarios (inspired by classics like GTFOBins and LOLBAS).

Why does RBAC matter?

RBAC is the last line of defense in Kubernetes security. If a workload gets compromised and an identity is stolen, a misconfigured or overly permissive RBAC policy (often seen with Operators) can let an attacker move laterally through the cluster — potentially leading to a full takeover. Alongside RBAC ATLAS, I’ve also been working on a tool called RBAC Scope — a static analyzer that checks RBAC policies against 100+ rules to flag risks and abuse scenarios. It’s built to be flexible and open for contributions, so the community can create their own rules. I’ll be releasing that project soon as well!

In the meantime, if you're curious to learn more — or want to invite me to speak at your conference — feel free to reach out. I’ll be talking about these tools at the Red Team Village during DEFCON 33.