Get cluster access posture (browser session)

Evaluates one cluster’s Kubernetes access posture from its kube gateway grants: a standing cluster-wide cluster-admin or admin grant, a grant over the organisation’s access policy, the creator’s grant left unchanged for 90 days on a GitOps cluster, and a grant identity the cluster’s apiserver verified can impersonate users, groups or service accounts (any of them or only named ones). Each finding names the grant and the commands that fix it; checks that could not be evaluated are listed under unknowns. Requires security.read; grantee emails appear only when the caller also holds kube_access.manage, otherwise a grantee is its grant_id and ankra_user_id.

GET /org/security/clusters/{cluster_id}/access-posture

Get cluster access posture (browser session)

Python

import requests

url = "https://api.platform.ankra.app/org/security/clusters/{cluster_id}/access-posture"

headers = {"cookie": "ankra_session="}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "evaluated_at": "2023-11-07T05:31:56Z",
  "summary": {
    "grants_total": 123,
    "standing_elevated": 123,
    "over_policy": 123,
    "impersonate_reachable": 123,
    "impersonate_verified_grants": 123
  },
  "findings": [
    {
      "check": "impersonate_reachable",
      "severity": "CRITICAL",
      "title": "<string>",
      "grant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "ankra_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "user_email": "<string>",
      "role": "<string>",
      "scope": "<string>",
      "namespace": "<string>",
      "detail": "<string>",
      "remediation": "<string>"
    }
  ],
  "unknowns": [
    {
      "check": "<string>",
      "grant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "reason": "<string>"
    }
  ]
}

Authorizations

ankra_session · string · cookie · required

Browser session. Mutations also require X-Ankra-CSRF.

Path Parameters

cluster_id · string<uuid> · required

Response

200

application/json

Successful response

A cluster's Kubernetes access posture: the summary line, every failed check with its remediation, and every check that could not be evaluated. A check on a grant absent from both findings and unknowns passed.

cluster_id · string<uuid> · required

evaluated_at · string<date-time> · required

summary · object · required

A cluster's Kubernetes access summary line (ankra-o1fa6.7). over_policy is null when the organisation's access policy could not be read; impersonate_reachable is null unless the impersonation probe has a fresh, verified answer for every live grant on the cluster. A verified denial covers every namespace and every RBAC rule, including rules scoped to named users, groups or service accounts; a cluster whose namespaces the probe could not all list and review, or whose authorizers cannot list their rules (a webhook authorizer), stays null. Null is unknown, never 0.

Show child attributes

findings · object[] · required

Show child attributes

unknowns · object[] · required

Show child attributes