mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-08-23 22:26:34 +00:00
ivanfetch-fw
01d7a8ac00
* Add `rolePodExecAttach` and `clusterrolePodExecAttach` checks * Add schema tests * Add clusterrolebindingPodExecAttach, rolebindingRolePodExecAttach, and rolebindingClusterRolePodExecAttach checks + schema-tests * Add the new checks to the full example config * Update checks' success/failure messages and add some helpful comments * Update binding-related check messaging RE: roleRef pointing to a nonexistent resource, and add tests for this case * Update rolebindingClusterRolePodExecAttach and rolebindingRolePodExecAttach to pass if a binding roleRef is a different kind, and schema tests to include a namespace * Add additional schema tests, remove "ignore default ClusterRole|Role bindings" code from checks that actually have no default bindings
35 lines
829 B
YAML
35 lines
829 B
YAML
# This succeeds because the ClusterRoleBinding is a default one (by name).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: cluster-admin
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: User
|
|
name: testuser
|
|
---
|
|
# This ClusterRole satisfies the above binding.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cluster-admin
|
|
rules:
|
|
- apiGroups: [ "" ]
|
|
resources: [ "pods/exec" ]
|
|
verbs: [ "create" ]
|
|
---
|
|
# This Role exists so there is at least one Role for the additionalSchema to find.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: not-used
|
|
namespace: test
|
|
rules:
|
|
- apiGroups: [ "" ]
|
|
resources: [ "pods" ]
|
|
verbs: [ "get" ]
|