Can this answer what a user can do?
It resolves permissions from the supplied manifests. A complete cluster answer also requires live roles, authorizer configuration, admission behavior, and other cluster context.
Kubernetes RBAC Analyzer
Resolve Kubernetes Role, ClusterRole, RoleBinding, ClusterRoleBinding, and subject relationships locally; trace permission sources and review broad access.
Local input limit: 5 MB · Processing timeout: 10 s
Analyze Kubernetes RBAC manifests
Paste related Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources. DecodeLens resolves only the supplied manifests and shows why each subject receives a permission.
RBAC YAML or JSON
0 KB
RBAC analysis
RBAC analysis
Resolved subjects, bindings, permission rules, source relationships, and focused findings will appear here.
Did DecodeLens help?
Support the continued development of independent, browser-local developer tools.
Trace permission sources without connecting to a cluster
The analyzer links subjects to bindings, resolves supplied roles, preserves namespace scope, and shows the exact rule path behind each grant.
What this result does not prove
- The tool does not contact Kubernetes, run SubjectAccessReview, or read live API discovery and admission configuration.
- A finding is a review signal, not proof of exploitability. A clean result is not proof of least privilege.
- Only supplied roles and bindings participate in the graph; missing built-in or aggregated roles remain unresolved.
- The manifests stay in this browser and are processed in a disposable worker with bounded document, resource, rule, subject, grant, finding, and time limits.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- Cloud & DevOps
Kubeconfig Inspector & Sanitizer
Map Kubernetes contexts, clusters, users, certificates, and authentication methods; detect risky settings and export a separate redacted copy.
Open tool - Security & identity
Kubernetes Secret Decoder & Inspector
Decode Kubernetes Secret values, inspect nested credential and file formats, or build a masked-by-default YAML/JSON manifest locally.
Open tool - Cloud & DevOps
AWS IAM Policy Inspector
Inspect AWS IAM identity, resource, and role trust policies; expand statements and conditions, and highlight broad or high-impact permissions locally.
Open tool - Data formats
JSON ↔ YAML Converter
Convert JSON and YAML in either direction, validate syntax, and inspect the result as a tree.
Open tool
Review RBAC before applying manifests
Paste the related roles and bindings together, inspect critical/high findings, then select a subject to trace each grant back to its binding and role.
Input
Role + RoleBinding + subjectsReview
subject → binding → role → permission rulesKubernetes RBAC Analyzer FAQ
Does it connect to my Kubernetes cluster?
No. It parses the pasted or selected files locally and performs no cluster, DNS, or network request.
Why is an aggregated ClusterRole partial?
aggregationRule selects other ClusterRoles by labels. Without the complete selected role set, the final rule list cannot be reconstructed truthfully.
Are the manifests uploaded?
No. Parsing and relationship analysis run in a disposable browser worker and manifest content is not included in analytics.