polaris/test/checks/rolePodExecAttach/success.system_prefix_binding.yaml at master - polaris - Gitea: Git with a nice cup of tea

mirror of https://github.com/FairwindsOps/polaris.git synced 2026-08-23 22:26:34 +00:00

Files

T

ivanfetch-fw 467d06f4db FWI-2719: Enable new RBAC / sensitive content / Pod exec checks, add hasPrefix and hasSuffix functions to the GO template, exempt system: name prefixes for RBAC checks, sensitive content checks ignore valueFrom, (#832 )

* Enable these checks in the default configuration file, which may produce many new results:
  * automountServiceAccountToken
  * linuxHardening
  * sensitiveConfigmapContent and sensitiveContainerEnvVar
  * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole
  * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and  rolebindingRolePodExecAttach
* Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default
* `hasPrefix` and `hasSuffix` functions are now available in the go template
* Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment
variable names when those variables use `valueFrom` to reference an
external resource.
* Add the `*ClusterAdmin` checks to `examples/config-full.yaml`.
* Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)

2022-11-14 15:05:02 -07:00

11 lines

255 B

YAML

Raw Permalink Blame History

 # This succeeds because the Role has an exempt `system:` prefix.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: system:controller:glbc
   namespace: kube-system
 rules:
   - apiGroups: [ "*" ]
     resources: [ "*" ]
     verbs: [ "*" ]