successMessage: The RoleBinding does not reference a Role with wildcard permissions
failureMessage: The RoleBinding references a Role with wildcard permissions
category: Security
target: rbac.authorization.k8s.io/RoleBinding
schemaString: |
  '$schema': http://json-schema.org/draft-07/schema
  type: object
  anyOf:
    # Pass RoleBindings that point to a ClusterRole.
    - required: ["roleRef"]
      properties:
        roleRef:
          required: ["kind"]
          properties:
            kind:
              type: string
              const: "ClusterRole"
    # Do not alert on default RoleBindings.
    - required: ["metadata"]
      properties:
        metadata:
          type: object
          required: ["name"]
          properties:
            name:
              type: string
              anyOf:
                - pattern: '^system:'
                - const: "gce:podsecuritypolicy:calico-sa"
    - required: ["roleRef"]
      properties:
        roleRef:
          required: ["apiGroup", "kind", "name"]
          properties:
            apiGroup:
              type: string
              const: "rbac.authorization.k8s.io"
            kind:
              type: string
              const: "Role"
            name:
              type: string
              minLength: 1
additionalSchemaStrings:
  rbac.authorization.k8s.io/Role: |
    type: object
    # This schema is validated for all roleBindings, regardless of their roleRef.
    {{ if eq .roleRef.kind "Role" }}
    {{ if and (not (hasPrefix .metadata.name "system:")) (ne .metadata.name "gce:podsecuritypolicy:calico-sa") }}
    required: ["metadata", "rules"]
    allOf:
      - properties:
          metadata:
            required: ["name"]
            properties:
              name:
                type: string
                const: "{{ .roleRef.name }}"
      - properties:
          rules:
            type: array
            items:
              type: object
              not:
                required: ["apiGroups", "resources", "verbs"]
                properties:
                  apiGroups:
                    type: array
                    contains:
                      type: string
                      const: "*"
                  resources:
                    type: array
                    contains:
                      type: string
                      const: '*'
                  verbs:
                    type: array
                    uniqueItems: true
                    oneOf:
                      - contains:
                          type: string
                          const: '*'
                      - minItems: 7
                        items:
                          type: string
                          enum:
                            - "get"
                            - "list"
                            - "watch"
                            - "create"
                            - "update"
                            - "patch"
                            - "delete"
    {{ end }}
    {{ end }}