Audit2RBAC

Overview

An open source tool created by Jordan Liggitt in the same vein as Netflix’s repokid allows you to generate RBAC resouce manifests for a specific service account using a Kubernetes audit log.

Install you package
Obtain the audit.log from a control plane node.

cat /var/log/kubernetes/audit.log

Run the tool

APP_NAME="my-app"
SA=my-service-account
ANNOTATIONS="tkg.tanzu.vmware.com/tanzu-package=contour-tkg-system"
LABELS=""

audit2rbac \
  --file audit.log \
  --serviceaccount "${SA}" \
  --generate-annotations "${ANNOTATIONS}" \
  --generate-labels="${LABELS}" \
  --generate-name "${APP_NAME}-system" > "${APP_NAME}-rbac.yaml"