Documentation
¶
Overview ¶
Package rbac is the engine module wrapper around internal/rbac. It projects identity/RBAC risks (over-permissive roles, exposed tokens, privilege- escalation paths, docker-group/socket exposure) into the unified Finding model. The heavy analysis lives in internal/rbac; this file only adapts the Risk values onto engine.Finding and wires the optional NHI feature to a target metadata flag so it stays off by default.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Module ¶
type Module struct{}
Module is the identity/RBAC analysis capability (CAPABILITY_SPEC domain 15, plus the Docker-side identity surface).
func (*Module) Analyze ¶
Analyze loads the cluster from the target, runs the analysis, and projects each Risk onto a Finding. When the target holds no RBAC objects, it returns nothing so generic filesystem scans stay quiet.
func (*Module) Description ¶
func (*Module) Supports ¶
func (m *Module) Supports(t engine.TargetType) bool
Supports handles filesystem targets: a directory or file of Kubernetes RBAC JSON (and our DockerHost descriptor). There is no dedicated k8s/config target type yet — see NOTES.md for the proposed engine change; until then a filesystem target is the carrier, and non-RBAC inputs produce no findings.
Source Files