mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-08-23 22:26:34 +00:00
ivanfetch-fw
467d06f4db
* Enable these checks in the default configuration file, which may produce many new results: * automountServiceAccountToken * linuxHardening * sensitiveConfigmapContent and sensitiveContainerEnvVar * clusterrolebindingClusterAdmin, rolebindingClusterAdminClusterRole, and rolebindingClusterAdminRole * clusterrolePodExecAttach, rolePodExecAttach, clusterrolebindingPodExecAttach, rolebindingClusterRolePodExecAttach, and rolebindingRolePodExecAttach * Ignore the `missingNetworkPolicy` and `automountServiceAccountToken` checks by default * `hasPrefix` and `hasSuffix` functions are now available in the go template * Fix the `sensitiveContainerEnvVar` check to ignore sensitive environment variable names when those variables use `valueFrom` to reference an external resource. * Add the `*ClusterAdmin` checks to `examples/config-full.yaml`. * Exempt the prefix `system:` instead of individual entries for RBAC checks (#871)
25 lines
499 B
YAML
25 lines
499 B
YAML
# This succeeds because the RoleBinding has an exempt `system:` prefix.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: test
|
|
namespace: test
|
|
rules:
|
|
- apiGroups: [ "*" ]
|
|
resources: [ "*" ]
|
|
verbs: [ "*" ]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: system:test
|
|
namespace: test
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: test
|
|
subjects:
|
|
- apiGroup: rbac.authorization.k8s.io
|
|
kind: User
|
|
name: testuser
|