Try Kubius
⌘K

Optimisation & nodes

RBAC Explorer

The RBAC Explorer (a Kubius Pro feature) makes Kubernetes access control legible without reading YAML. It resolves effective permissions from the cluster’s Roles, ClusterRoles, RoleBindings and ClusterRoleBindings, and answers the question in both directions. Open it from the FEATURES band in the sidebar.

It works entirely from the RBAC objects Kubius already watches - there are no extra API calls, and nothing is changed.

What can a subject do?

Pick a ServiceAccount, User or Group and Kubius lists every rule it holds:

  • Grouped by scope - cluster-wide (from a ClusterRoleBinding) versus a specific namespace (from a RoleBinding).
  • The full grant path - each rule shows the exact binding → role that granted it, so you can trace and trim.
  • High-privilege rules are flagged - wildcard verbs or resources, access to secrets, and the escalation verbs escalate / bind / impersonate are highlighted so dangerous grants stand out.

The subject list is drawn from every ServiceAccount in the cluster plus any user or group actually referenced by a binding.

Who can perform an action?

Switch to the reverse mode to audit an action - for example “who can delete pods in prod?”. Choose a verb, a resource (and optionally an API group and namespace), and Kubius lists every subject that can do it, each with the binding that grants it and whether it applies cluster-wide or in a single namespace.

Leave the namespace blank to search every namespace at once.

How it evaluates

A rule matches an action when its verbs, API groups and resources each contain the requested value or the * wildcard. RoleBinding rules apply only within the binding’s namespace (even when they reference a ClusterRole); ClusterRoleBinding rules apply cluster-wide.

Caveats

  • It reflects the RBAC objects visible to your current credentials - if you can’t list Roles in a namespace, they can’t be evaluated.
  • Roles expressed only through matchExpressions-style aggregation labels, and external authorizers (webhooks, cloud IAM such as GKE/EKS/AKS), are outside Kubernetes RBAC and aren’t evaluated here.
  • resourceNames restrictions are shown on a grant but the reverse search treats a name-restricted rule as still granting the verb.