fix(k8s): simplify resource_id, document ServiceAccount exclusion

Remove dead namespace branch in resource_id (User/Group subjects in
ClusterRoleBindings always have namespace=""). Add comment explaining
why ServiceAccount subjects are filtered out. Simplify loop variable
unpacking.

prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py

@@ -15,19 +15,16 @@ class rbac_minimize_csr_approval_access(Check):
         subjects_bound_roles = {}
         for crb in rbac_client.cluster_role_bindings.values():
             for subject in crb.subjects:
+                # CIS benchmarks scope these checks to human identities only
                 if subject.kind in ["User", "Group"]:
                     key = (subject.kind, subject.name, subject.namespace)
                     if key not in subjects_bound_roles:
                         subjects_bound_roles[key] = (subject, set())
                     subjects_bound_roles[key][1].add(crb.roleRef.name)
 
-        for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
+        for _, (subject, role_names) in subjects_bound_roles.items():
             report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
-            report.resource_id = (
-                f"{subject.kind}/{subject.name}"
-                if not subject.namespace
-                else f"{subject.kind}/{subject.namespace}/{subject.name}"
-            )
+            report.resource_id = f"{subject.kind}/{subject.name}"
             report.status = "PASS"
             report.status_extended = f"User or group '{subject.name}' does not have access to update the CSR approval sub-resource."
             for cr in rbac_client.cluster_roles.values():

prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py

@@ -15,19 +15,16 @@ class rbac_minimize_node_proxy_subresource_access(Check):
         subjects_bound_roles = {}
         for crb in rbac_client.cluster_role_bindings.values():
             for subject in crb.subjects:
+                # CIS benchmarks scope these checks to human identities only
                 if subject.kind in ["User", "Group"]:
                     key = (subject.kind, subject.name, subject.namespace)
                     if key not in subjects_bound_roles:
                         subjects_bound_roles[key] = (subject, set())
                     subjects_bound_roles[key][1].add(crb.roleRef.name)
 
-        for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
+        for _, (subject, role_names) in subjects_bound_roles.items():
             report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
-            report.resource_id = (
-                f"{subject.kind}/{subject.name}"
-                if not subject.namespace
-                else f"{subject.kind}/{subject.namespace}/{subject.name}"
-            )
+            report.resource_id = f"{subject.kind}/{subject.name}"
             report.status = "PASS"
             report.status_extended = f"User or group '{subject.name}' does not have access to the node proxy sub-resource."
             for cr in rbac_client.cluster_roles.values():

prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py

@@ -15,19 +15,16 @@ class rbac_minimize_pv_creation_access(Check):
         subjects_bound_roles = {}
         for crb in rbac_client.cluster_role_bindings.values():
             for subject in crb.subjects:
+                # CIS benchmarks scope these checks to human identities only
                 if subject.kind in ["User", "Group"]:
                     key = (subject.kind, subject.name, subject.namespace)
                     if key not in subjects_bound_roles:
                         subjects_bound_roles[key] = (subject, set())
                     subjects_bound_roles[key][1].add(crb.roleRef.name)
 
-        for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
+        for _, (subject, role_names) in subjects_bound_roles.items():
             report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
-            report.resource_id = (
-                f"{subject.kind}/{subject.name}"
-                if not subject.namespace
-                else f"{subject.kind}/{subject.namespace}/{subject.name}"
-            )
+            report.resource_id = f"{subject.kind}/{subject.name}"
             report.status = "PASS"
             report.status_extended = f"User or group '{subject.name}' does not have access to create PersistentVolumes."
             for cr in rbac_client.cluster_roles.values():

prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py

@@ -15,19 +15,16 @@ class rbac_minimize_service_account_token_creation(Check):
         subjects_bound_roles = {}
         for crb in rbac_client.cluster_role_bindings.values():
             for subject in crb.subjects:
+                # CIS benchmarks scope these checks to human identities only
                 if subject.kind in ["User", "Group"]:
                     key = (subject.kind, subject.name, subject.namespace)
                     if key not in subjects_bound_roles:
                         subjects_bound_roles[key] = (subject, set())
                     subjects_bound_roles[key][1].add(crb.roleRef.name)
 
-        for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
+        for _, (subject, role_names) in subjects_bound_roles.items():
             report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
-            report.resource_id = (
-                f"{subject.kind}/{subject.name}"
-                if not subject.namespace
-                else f"{subject.kind}/{subject.namespace}/{subject.name}"
-            )
+            report.resource_id = f"{subject.kind}/{subject.name}"
             report.status = "PASS"
             report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens."
             for cr in rbac_client.cluster_roles.values():

prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py

@@ -18,19 +18,16 @@ class rbac_minimize_webhook_config_access(Check):
         subjects_bound_roles = {}
         for crb in rbac_client.cluster_role_bindings.values():
             for subject in crb.subjects:
+                # CIS benchmarks scope these checks to human identities only
                 if subject.kind in ["User", "Group"]:
                     key = (subject.kind, subject.name, subject.namespace)
                     if key not in subjects_bound_roles:
                         subjects_bound_roles[key] = (subject, set())
                     subjects_bound_roles[key][1].add(crb.roleRef.name)
 
-        for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
+        for _, (subject, role_names) in subjects_bound_roles.items():
             report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
-            report.resource_id = (
-                f"{subject.kind}/{subject.name}"
-                if not subject.namespace
-                else f"{subject.kind}/{subject.namespace}/{subject.name}"
-            )
+            report.resource_id = f"{subject.kind}/{subject.name}"
             report.status = "PASS"
             report.status_extended = f"User or group '{subject.name}' does not have access to create, update, or delete webhook configurations."
             for cr in rbac_client.cluster_roles.values():