Kubernetes RBAC Access Denied Repair Prompt

The raw audit log line or event describing the denied API request, including user, verb, resource, namespace, and timestamp.

{"kind":"Event","user":{"username":"app-sa"},"verb":"list","objectRef":{"resource":"pods","namespace":"prod"},"responseStatus":{"code":403}}

Must be valid JSON. Check for presence of user.username, verb, objectRef.resource, and objectRef.namespace fields. Reject if responseStatus.code is not 403.

The current Role or ClusterRole manifest that should grant access but is failing. Include the full YAML document.

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: pod-reader namespace: prod rules:

• apiGroups: [""] resources: ["pods"] verbs: ["get", "watch"]

Must parse as valid Kubernetes RBAC YAML. Validate kind is Role or ClusterRole. Reject if apiVersion is not recognized. Check for at least one rule block.

The RoleBinding or ClusterRoleBinding that links the denied subject to the role. Include the full YAML document.

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: read-pods namespace: prod subjects:

• kind: ServiceAccount name: app-sa namespace: prod roleRef: kind: Role name: pod-reader

Must parse as valid Kubernetes RBAC YAML. Validate kind is RoleBinding or ClusterRoleBinding. Check that subjects array is non-empty and roleRef.name matches a known role. Reject if namespace does not match audit log namespace.

The fully qualified name of the user, group, or service account that was denied. Extracted from the audit log.

system:serviceaccount:prod:app-sa

Must match the subject in the binding. For service accounts, validate format system:serviceaccount:<namespace>:<name>. For users, validate against expected user prefix. For groups, validate against expected group prefix.

The Kubernetes namespace where the denied request occurred. Used to scope the repair to the correct namespace.

prod

Must be a valid Kubernetes namespace name (RFC 1123 DNS label). Must match the namespace in the audit log and the namespace of the Role and RoleBinding. Reject if empty or set to 'default' without explicit confirmation.

The specific API verb that was denied, such as get, list, watch, create, update, patch, or delete.

list

Must be one of the standard Kubernetes API verbs: get, list, watch, create, update, patch, delete, deletecollection. Reject if verb is escalate, bind, or impersonate without explicit security review flag.

The Kubernetes resource type that was denied, such as pods, services, deployments, or secrets.

pods

Must be a valid Kubernetes resource name. Validate against a known resource list or allow any string matching RFC 1123 subdomain. Reject if resource is secrets, configmaps, or serviceaccounts/token without explicit security review flag.

The API group of the denied resource. Empty string for core resources, or a named group like apps, networking.k8s.io, or rbac.authorization.k8s.io.

""

Must be a valid Kubernetes API group string. Use empty string for core resources. Validate format as DNS subdomain or empty. Reject if group is rbac.authorization.k8s.io or certificates.k8s.io without explicit security review flag.

enum: Role | ClusterRole | RoleBinding | ClusterRoleBinding

Must exactly match one of the four enum values. Reject any other string.

string (YAML)

Must parse as valid YAML. Must contain apiVersion, kind, and metadata.name. Kind must match repair_type.

string

Must be non-empty. Must reference the specific error from [ERROR_LOG] and the specific RBAC rule that was missing or misconfigured.

object

Must contain 'subject_kind' (string), 'subject_name' (string), and 'namespace' (string or null). If repair_type is ClusterRoleBinding, namespace must be null.

boolean

Must be true if the repair is scoped to a single namespace. Must be false if repair_type is ClusterRole or ClusterRoleBinding. Validate against repair_type.

string (YAML diff)

If present, must be a valid unified diff or structured patch showing only the changed lines from [CURRENT_MANIFEST]. Null allowed when no original manifest was provided.

string

Must list the exact API groups, resources, and verbs granted. Must not include wildcard verbs or resources unless explicitly present in the denied request audit log.

array of strings

If present, each string must describe a non-blocking concern (e.g., broad resource pattern, missing resourceNames). Null or empty array allowed when no warnings apply.

Proposed binding references only the subject from [DENIED_SUBJECT] and does not grant permissions to additional users, groups, or service accounts.

Output contains a subjects list with entries not present in the original denied request audit log.

Parse the proposed manifest and diff the subjects field against the input [DENIED_SUBJECT]. Fail if any new subject is introduced.

Proposed RoleBinding is scoped to the namespace in [DENIED_NAMESPACE]. ClusterRoleBinding is proposed only when the denied resource is cluster-scoped.

A ClusterRoleBinding is proposed for a namespaced resource, or a RoleBinding references a namespace different from the denied request.

Inspect the kind field of the proposed binding. If the denied resource is namespaced and kind is ClusterRoleBinding, fail. If namespace metadata differs from [DENIED_NAMESPACE], fail.

Proposed Role or ClusterRole adds only the specific API group, resource, and verb that were denied. No wildcard verbs or resources are introduced unless already present in [EXISTING_MANIFESTS].

Output contains a rule with '*' in verbs, resources, or apiGroups that was not present in the existing authorized manifest.

Parse the rules array of the proposed role. Flag any rule where verbs, resources, or apiGroups contain '*' and that exact wildcard rule is absent from [EXISTING_MANIFESTS].

Proposed YAML parses successfully and contains valid apiVersion, kind, metadata, and spec fields for a Kubernetes RBAC object.

YAML parser throws an error, or the parsed object is missing required fields such as metadata.name or roleRef.

Run a strict YAML parser on the output. Validate the parsed object against the Kubernetes RBAC v1 schema. Fail on any parsing error or missing required field.

The explanation references the specific error code or message from [DENIED_ERROR_LOG] and maps it to the proposed fix.

The explanation is generic, does not mention the specific error, or proposes a fix unrelated to the error message.

Check that the explanation string contains a substring from [DENIED_ERROR_LOG] or a direct paraphrase of the denial reason. Fail if no alignment is found.

Proposed role does not include an aggregationRule that would pull in broader permissions than the denied request requires.

Output includes an aggregationRule field that was not present in [EXISTING_MANIFESTS] and would expand permissions beyond the denied verb.

Parse the output for the presence of an aggregationRule. If found, compare the clusterRoleSelectors against existing cluster roles. Fail if the aggregated permissions exceed the denied verb and resource.

If [DENIED_ERROR_LOG] indicates a resourceNames restriction failure, the proposed role includes resourceNames matching the denied request.

The proposed role omits resourceNames when the error log shows a denial for a specific named resource, or adds incorrect resource names.

Extract the resource name from [DENIED_ERROR_LOG]. Verify the proposed role's rule for the denied resource includes a resourceNames array containing that exact name. Fail if missing or mismatched.

Output contains only the corrected manifest and explanation. No extraneous commentary, markdown fences outside the YAML block, or conversational filler.

Output includes phrases like 'Here you go', 'I hope this helps', or multiple YAML alternatives with commentary.

Check the output string for conversational preamble or sign-off patterns. Fail if the output is not strictly the corrected YAML block and a single explanation paragraph.