rback

README

rback

A simple "RBAC in Kubernetes" visualizer. No matter how complex the setup, rback queries all RBAC related information of a Kubernetes cluster in constant time and generates a graph representation of service accounts, (cluster) roles, and the respective access rules in Graphviz dot format.

For example, here is an Amazon EKS cluster as seen by rback:

Another example would be a local K3S cluster:

See the examples/ directory for more samples.

---

Installation

rback requires access to a Kubernetes cluster (e.g., EKS, GKE, AKS, k3s, kind, Minikube) and kubectl configured locally.

Pre-built Binaries

Download the latest pre-compiled binary for your architecture (macOS Intel & Apple Silicon, Linux amd64 & arm64, Windows) from the Releases page:

# Example for macOS (Apple Silicon / arm64)
curl -sL https://github.com/tmojzes/rback/releases/latest/download/rback_darwin_arm64.tar.gz | tar -xz
chmod +x rback && sudo mv rback /usr/local/bin

# Example for Linux (x86_64 / amd64)
curl -sL https://github.com/tmojzes/rback/releases/latest/download/rback_linux_amd64.tar.gz | tar -xz
chmod +x rback && sudo mv rback /usr/local/bin

Via go install

If you have Go installed:

go install github.com/tmojzes/rback@latest

Building From Source

Clone the repository and build using Task:

git clone https://github.com/tmojzes/rback.git
cd rback
task build
# or install directly to $GOPATH/bin:
task install

[!NOTE] If you do not have task installed globally, you can invoke it directly via Go's tool mechanism:

go tool task build

---

Using rback Directly

Query the cluster using kubectl and pipe the JSON output to rback:

kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback > result.dot

Alternatively, read from a saved file using -f:

rback -f rbac-dump.json > result.dot

Rendering the Graph

Render Locally

Install Graphviz (brew install graphviz on macOS or sudo apt-get install graphviz on Linux):

# On macOS:
kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback | dot -Tpng > /tmp/rback.png && open /tmp/rback.png

# On Linux:
kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback | dot -Tpng > /tmp/rback.png && xdg-open /tmp/rback.png

Render Online

You can paste the generated .dot content directly into browser-based Graphviz viewers such as:

• magjac.com/graphviz-visual-editor/
• dreampuf.github.io/GraphvizOnline

---

Using rback as a kubectl Plugin

A plugin script is provided in kubectl-plugin/kubectl-rback. To install:

1. Copy or symlink kubectl-plugin/kubectl-rback into your PATH (e.g. /usr/local/bin/kubectl-rback).
2. Ensure it is executable (chmod +x /usr/local/bin/kubectl-rback).
3. Ensure both rback and Graphviz dot are in your PATH.

Now run:

kubectl rback

This will automatically query the cluster, generate the graph, render a PNG, and open it in your default image viewer (supporting both macOS and Linux).

---

Usage Examples

Filtering by Namespace

Focus on a single namespace or comma-separated list of namespaces:

kubectl rback -n my-namespace
kubectl rback -n my-namespace1,my-namespace2

Focusing on Specific Resources

To focus on a specific resource and its direct relationships:

# ServiceAccounts:
kubectl rback serviceaccount my-service-account
kubectl rback sa my-service-account

# Roles & ClusterRoles:
kubectl rback role my-role
kubectl rback clusterrole my-cluster-role

# RoleBindings & ClusterRoleBindings:
kubectl rback rolebinding my-role-binding
kubectl rback clusterrolebinding my-cluster-role-binding

Short aliases are supported: sa, r, cr, rb, crb, u (user), g (group).

You can also specify multiple resource names:

kubectl rback r my-role1 my-role2

Checking Permissions (who-can)

Find out who can perform an action in the cluster:

kubectl rback who-can create pods
kubectl rback who-can get secrets
kubectl rback who-can list services

This renders matched (Cluster)Roles, related bindings, and subjects (ServiceAccounts, Users, Groups). The matched rule is highlighted in bold.

To only show the matched rules instead of all rules in the role:

kubectl rback --show-matched-rules-only who-can create pods

Toggling Rules & Legend

Hide access rules completely:

kubectl rback --show-rules=false

Hide the graph legend:

kubectl rback --show-legend=false

---

Development

All development tasks are managed via Task:

# List available tasks
task --list

# Build local binary
task build

# Run unit tests with race detection
task test

# Generate test coverage report
task test:coverage

# Run linter / go vet
task lint

# Install binary to $GOPATH/bin
task install

# Clean build artifacts
task clean

[!NOTE] If you don't have task installed, prepend go tool (e.g. go tool task test).

---

Attribution & License

rback was originally created by Michael Hausenblas and maintained under team-soteria/rback.

This fork is actively maintained by Tamás Mojzes.

Distributed under the Apache License 2.0.