native-cube · marcincuber · Aug 12, 2026 · Aug 12, 2026
diff --git a/.github/workflows/lighthouse.yml b/.github/workflows/lighthouse.yml
@@ -57,6 +57,7 @@ jobs:
           urls: |
             http://127.0.0.1:8080/
             http://127.0.0.1:8080/k8s-manifest-builder/
+            http://127.0.0.1:8080/kubernetes-rbac-explorer/
             http://127.0.0.1:8080/visual-subnet-calculator/
             http://127.0.0.1:8080/yaml-formatter/
             http://127.0.0.1:8080/terraform-modules/
diff --git a/README.md b/README.md
@@ -32,6 +32,18 @@ The shorter `/json-formatter/` alias redirects to this tool.
 YAML parsing and serialization use the vendored `js-yaml` 4.1.0 browser
 bundle, distributed under the MIT license included with the tool.
 
+## Kubernetes RBAC Explorer
+
+Open `/kubernetes-rbac-explorer/` to turn Kubernetes Roles and bindings into
+an effective access map. The tool resolves subject-to-role grant paths, answers
+permission questions, highlights review-worthy access, compares policy
+snapshots, generates narrowly scoped RBAC drafts, and exports a Markdown review.
+
+The explorer accepts multi-document YAML, JSON arrays, and Kubernetes `List`
+objects. Parsing and analysis stay in the browser. Secret objects are rejected,
+and users should never provide a kubeconfig, token, or other credentials. YAML
+input uses the existing vendored `js-yaml` 4.1.0 bundle.
+
 ## Terraform Modules
 
 Open `/terraform-modules/` to explore public AWS Terraform modules
@@ -77,13 +89,22 @@ its required 1200×630 PNG with:
 sh scripts/render-social-card.sh
 ```
 
+Other social cards can use the same renderer by supplying both paths, for example:
+
+```sh
+sh scripts/render-social-card.sh \
+  assets/social/kubernetes-rbac-explorer.svg \
+  assets/social/kubernetes-rbac-explorer.png
+```
+
 ## To preview locally
 
 ```sh
 python3 -m http.server 8080
 ```
 
 - `http://localhost:8080/k8s-manifest-builder/`
+- `http://localhost:8080/kubernetes-rbac-explorer/`
 - `http://localhost:8080/visual-subnet-calculator/`
 - `http://localhost:8080/yaml-formatter/`
 - `http://localhost:8080/terraform-modules/`

diff --git a/assets/social/kubernetes-rbac-explorer.png b/assets/social/kubernetes-rbac-explorer.png
diff --git a/assets/social/kubernetes-rbac-explorer.svg b/assets/social/kubernetes-rbac-explorer.svg
diff --git a/index.html b/index.html
@@ -279,17 +279,19 @@
       }
 
       .tools {
-        display: grid;
-        grid-template-columns: repeat(2, minmax(0, 340px));
+        display: flex;
+        flex-wrap: wrap;
         justify-content: center;
         gap: 28px;
       }
 
       .tool {
         position: relative;
         display: flex;
+        width: min(100%, 340px);
         aspect-ratio: 1;
         min-width: 0;
+        flex: 0 1 340px;
         flex-direction: column;
         padding: clamp(24px, 3vw, 30px);
         overflow: hidden;
@@ -428,6 +430,7 @@
         }
 
         .tools {
+          display: grid;
           grid-template-columns: minmax(0, 340px);
           gap: 22px;
         }
@@ -438,6 +441,13 @@
           flex-direction: column;
         }
       }
+
+      @media (min-width: 561px) and (max-width: 920px) {
+        .tools {
+          display: grid;
+          grid-template-columns: repeat(2, minmax(0, 340px));
+        }
+      }
     </style>
   </head>
   <body>
@@ -484,8 +494,8 @@
       <p class="eyebrow">Purpose-built infrastructure utilities</p>
       <h1>Free tools for cloud-native work.</h1>
       <p class="intro">
-        Generate Kubernetes manifests, visually plan IPv4 subnets, format YAML
-        or JSON, and discover reusable AWS Terraform modules.
+        Generate Kubernetes manifests, review RBAC access, visually plan IPv4
+        subnets, format configuration, and discover reusable Terraform modules.
       </p>
       <p class="author-byline">
         <span>Created and maintained by</span>
@@ -518,6 +528,24 @@ <h2>Kubernetes Manifest Builder</h2>
           </p>
           <span class="arrow" aria-hidden="true">↗</span>
         </a>
+        <a class="tool" href="./kubernetes-rbac-explorer/">
+          <span class="tag">Available now</span>
+          <svg
+            class="tool-cube"
+            viewBox="0 0 40 40"
+            aria-hidden="true"
+          >
+            <path d="M20 2.5 36 11.3 20 20 4 11.3 20 2.5Z" fill="#2563eb" />
+            <path d="M4 11.3 20 20v17.5L4 28.7V11.3Z" fill="#14243b" />
+            <path d="M36 11.3 20 20v17.5l16-8.8V11.3Z" fill="#22a77a" />
+            <path d="m20 8 6 3.3-6 3.2-6-3.2L20 8Z" fill="#f2f5f9" />
+          </svg>
+          <h2>Kubernetes RBAC Explorer</h2>
+          <p>
+            Map effective permissions, test access, and surface risky RBAC grants.
+          </p>
+          <span class="arrow" aria-hidden="true">↗</span>
+        </a>
         <a class="tool" href="./visual-subnet-calculator/">
           <span class="tag">Available now</span>
           <svg