Documentation
¶
Overview ¶
Package rbac scans the cluster's RBAC graph (ClusterRoles, RoleBindings, ServiceAccounts) and flags wildcard permissions and over-broad bindings.
Index ¶
Constants ¶
View Source
const Name = "rbac"
Name is the registry key for this scanner.
Variables ¶
This section is empty.
Functions ¶
func NewScanner ¶
NewScanner returns a scanner that collects RBAC configuration from a cluster.
Types ¶
type BindingInfo ¶
type BindingInfo struct {
// Kind is "ClusterRoleBinding" or "RoleBinding".
Kind string `json:"kind"`
// Namespace is empty for ClusterRoleBindings.
Namespace string `json:"namespace,omitempty"`
// Name is the binding name.
Name string `json:"name"`
// RoleRef is the name of the role being bound.
RoleRef string `json:"role_ref"`
// SubjectCount is the number of subjects in the binding.
SubjectCount int `json:"subject_count"`
}
BindingInfo describes a ClusterRoleBinding or RoleBinding.
type Data ¶
type Data struct {
// ClusterRoleCount is the number of ClusterRoles.
ClusterRoleCount int `json:"cluster_role_count"`
// RoleCount is the number of namespaced Roles.
RoleCount int `json:"role_count"`
// ClusterRoleBindingCount is the number of ClusterRoleBindings.
ClusterRoleBindingCount int `json:"cluster_role_binding_count"`
// RoleBindingCount is the number of namespaced RoleBindings.
RoleBindingCount int `json:"role_binding_count"`
// Roles lists all ClusterRoles and Roles.
Roles []RoleInfo `json:"roles"`
// Bindings lists all ClusterRoleBindings and RoleBindings.
Bindings []BindingInfo `json:"bindings"`
}
Data holds RBAC information for one cluster.
type RoleInfo ¶
type RoleInfo struct {
// Kind is "ClusterRole" or "Role".
Kind string `json:"kind"`
// Namespace is empty for ClusterRoles.
Namespace string `json:"namespace,omitempty"`
// Name is the role name.
Name string `json:"name"`
// RuleCount is the number of policy rules attached.
RuleCount int `json:"rule_count"`
}
RoleInfo describes a ClusterRole or Role.
Click to show internal directories.
Click to hide internal directories.