Connected Resources & RBAC Risk

The Kubernetes agent can collect the resources connected to each workload and use them to surface two signals in Operations: rbac-risk and exposed.

What it does

When enabled, the agent collects the following per workload:

• ServiceAccounts and their resolved effective RBAC rules
• RoleBindings (and ClusterRoleBindings) in scope
• Services bound to the workload
• ConfigMaps referenced by the workload
• Secrets referenced by the workload (keys only, values are stripped agent-side and never sent)
• PersistentVolumeClaims attached to the workload

Shoehorn uses this data to derive two signals visible in the Operations view and the Connected Resources section of the entity drawer:

• rbac-risk — fires when a workload runs under a ServiceAccount bound to cluster-admin, a wildcard verb (*), or an escalation permission (bind, escalate, impersonate).
• exposed — fires when a workload is reachable via a LoadBalancer or NodePort Service.

Enabling connected resource collection

Collection is off by default. Enable it in your K8s agent values file:

agent:
  connected:
    enabled: true

Terraform module

The shoehorn-kubernetes Terraform module exposes this as a first-class variable:

Variable	Purpose
agent_connected_enabled	Turn connected resource collection on. Off by default.

module "shoehorn" {
  source = "shoehorn-dev/kubernetes/shoehorn"

  agent_connected_enabled = true
  # ... other variables
}

Security note

Enabling this grants the agent list and get on Secrets in its configured scope, the same grant used by Helm detection. The agent strips all Secret values before sending data to the platform. Only Secret names and keys are reported, so credentials never leave the cluster.

If you prefer not to grant Secret read access, leave agent.connected.enabled off. The rbac-risk and exposed signals simply won’t appear.