Kube Permission
Evidence Field kit · $49

Field note 01 Read-only Kubernetes RBAC

Trace every permission to its source.

Replace YAML spelunking and terminal screenshots with a point-in-time evidence packet that names the subject, binding, role, and exact matching rule.

Install the CLI Examine a live proof
Cluster writes
None
Data leaves cluster
Never
Packet formats
MD · JSON
Pressed fern specimen with roots, branches, blank evidence tags, and a rust thread tracing one path from root to leaf
Fig. A One permission, traced from subject to resource.

Read-only boundary

get/list roles · rolebindings · clusterroles · clusterrolebindings

No agents. No token retention.

The proof method

A field key for effective access

Each verdict stays attached to the evidence that produced it. When more than one path grants access, the report records all of them.

  1. 01

    Collect the habitat

    Fetch only the four RBAC object families and the server version. Save a reusable snapshot for offline review.

    kpe snapshot --output rbac.json
  2. 02

    Test bounded questions

    Name one subject and a small JSON matrix of verbs, resources, namespaces, subresources, or URLs.

    --subject user:mina --matrix checks.json
  3. 03

    Preserve the provenance

    Export readable and structured companions. Sign the JSON with your own offline Ed25519 key when custody matters.

    evidence.md + evidence.json

Live specimen

Follow the causal path

This recorded, in-browser example uses fictional RBAC data. Nothing is uploaded and no cluster is contacted.

Run it where the evidence lives

One binary. No operator.

Build from inspectable Rust source today. Release binaries are attached by the factory after publishing.

  • Works from a least-privilege kubeconfig
  • Runs again from a token-free snapshot
  • Deterministic rule matching, covered by a 20-case fixture

Download an example access matrix

FIELD TERMINAL / 0.1.0
$ cargo install --git https://github.com/B-Divyesh/sf-kube-permission-evidence

$ kpe report \
    --subject user:alice@example.com \
    --as-group platform-engineers \
    --matrix checks.json \
    --output audit-2026-08

Wrote audit-2026-08.md and audit-2026-08.json
(14 allowed, 6 denied, 1 uncertain).

Version behavior

Honest about what the snapshot cannot know.

Kubernetes stores controller-resolved rules for aggregated ClusterRoles. KPE evaluates those collected rules, records the server version, and marks each affected proof uncertain. Webhook and Node authorizers remain explicitly outside the claim.

⚠ Marked
uncertain

The field kit

Keep the evaluator free. Fund the audit workflow.

Every operator gets complete collection, evaluation, Markdown/JSON export, signing, and verification. The one-time Field Kit adds maintained prebuilt binaries, batch subject manifests, cover-sheet templates, and priority update notes.

$49

One-time purchase · one team

Buy the field kit
Have a license? Restore it

Stored only in this browser. We send it solely to Sociobot for verification.

No field-kit license stored.

Sociobot/Dodo is the merchant of record. Refunds are handled there and revoke the license. Privacy · Terms

Bring one question

Leave with an evidence trail.

Install KPE 0.1.0