mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-08-23 22:26:34 +00:00
ivanfetch-fw
467d06f4db
* Enable these checks in the default configuration file, which may produce many new results: * automountServiceAccountToken * linuxHardening * sensitiveConfigmapContent and sensitiveContainerEnvVar * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and rolebindingRolePodExecAttach * Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default * `hasPrefix` and `hasSuffix` functions are now available in the go template * Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment variable names when those variables use `valueFrom` to reference an external resource. * Add the `*ClusterAdmin` checks to `examples/config-full.yaml`. * Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)
34 lines
750 B
YAML
34 lines
750 B
YAML
# This succeeds because the clusterRoleBinding has an exempt `system:` prefix.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: test
|
|
rules:
|
|
- apiGroups: [ "*" ]
|
|
resources: [ "*" ]
|
|
verbs: [ "*" ]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: system:test
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: test
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: User
|
|
name: testuser
|
|
---
|
|
# This Role exists so there is at least one Role for the additionalSchema to find.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: not-used
|
|
namespace: test
|
|
rules:
|
|
- apiGroups: [ "" ]
|
|
resources: [ "pods" ]
|
|
verbs: [ list ]
|