rbac

package
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 7, 2026 License: MIT Imports: 5 Imported by: 0

Documentation

Overview

Package rbac scans the cluster's RBAC graph (ClusterRoles, RoleBindings, ServiceAccounts) and flags wildcard permissions and over-broad bindings.

Index

Constants

View Source
const Name = "rbac"

Name is the registry key for this scanner.

Variables

This section is empty.

Functions

func NewScanner

func NewScanner() scanner.Scanner

NewScanner returns a scanner that collects RBAC configuration from a cluster.

Types

type BindingInfo

type BindingInfo struct {
	// Kind is "ClusterRoleBinding" or "RoleBinding".
	Kind string `json:"kind"`
	// Namespace is empty for ClusterRoleBindings.
	Namespace string `json:"namespace,omitempty"`
	// Name is the binding name.
	Name string `json:"name"`
	// RoleRef is the name of the role being bound.
	RoleRef string `json:"role_ref"`
	// SubjectCount is the number of subjects in the binding.
	SubjectCount int `json:"subject_count"`
}

BindingInfo describes a ClusterRoleBinding or RoleBinding.

type Data

type Data struct {
	// ClusterRoleCount is the number of ClusterRoles.
	ClusterRoleCount int `json:"cluster_role_count"`
	// RoleCount is the number of namespaced Roles.
	RoleCount int `json:"role_count"`
	// ClusterRoleBindingCount is the number of ClusterRoleBindings.
	ClusterRoleBindingCount int `json:"cluster_role_binding_count"`
	// RoleBindingCount is the number of namespaced RoleBindings.
	RoleBindingCount int `json:"role_binding_count"`
	// Roles lists all ClusterRoles and Roles.
	Roles []RoleInfo `json:"roles"`
	// Bindings lists all ClusterRoleBindings and RoleBindings.
	Bindings []BindingInfo `json:"bindings"`
}

Data holds RBAC information for one cluster.

type RoleInfo

type RoleInfo struct {
	// Kind is "ClusterRole" or "Role".
	Kind string `json:"kind"`
	// Namespace is empty for ClusterRoles.
	Namespace string `json:"namespace,omitempty"`
	// Name is the role name.
	Name string `json:"name"`
	// RuleCount is the number of policy rules attached.
	RuleCount int `json:"rule_count"`
}

RoleInfo describes a ClusterRole or Role.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL