From 1849520008f7e34b5b0b5b0166889ac3d248dde2 Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Wed, 4 Mar 2026 08:50:53 +0100 Subject: [PATCH] fix(k8s): simplify resource_id, document ServiceAccount exclusion Remove dead namespace branch in resource_id (User/Group subjects in ClusterRoleBindings always have namespace=""). Add comment explaining why ServiceAccount subjects are filtered out. Simplify loop variable unpacking. --- .../rbac_minimize_csr_approval_access.py | 9 +++------ .../rbac_minimize_node_proxy_subresource_access.py | 9 +++------ .../rbac_minimize_pv_creation_access.py | 9 +++------ .../rbac_minimize_service_account_token_creation.py | 9 +++------ .../rbac_minimize_webhook_config_access.py | 9 +++------ 5 files changed, 15 insertions(+), 30 deletions(-) diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py index afadb889a0..7daf1d7c94 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py @@ -15,19 +15,16 @@ class rbac_minimize_csr_approval_access(Check): subjects_bound_roles = {} for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: + # CIS benchmarks scope these checks to human identities only if subject.kind in ["User", "Group"]: key = (subject.kind, subject.name, subject.namespace) if key not in subjects_bound_roles: subjects_bound_roles[key] = (subject, set()) subjects_bound_roles[key][1].add(crb.roleRef.name) - for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): + for _, (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) - report.resource_id = ( - f"{subject.kind}/{subject.name}" - if not subject.namespace - else f"{subject.kind}/{subject.namespace}/{subject.name}" - ) + report.resource_id = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to update the CSR approval sub-resource." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py index 21d437be52..dc418325df 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py @@ -15,19 +15,16 @@ class rbac_minimize_node_proxy_subresource_access(Check): subjects_bound_roles = {} for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: + # CIS benchmarks scope these checks to human identities only if subject.kind in ["User", "Group"]: key = (subject.kind, subject.name, subject.namespace) if key not in subjects_bound_roles: subjects_bound_roles[key] = (subject, set()) subjects_bound_roles[key][1].add(crb.roleRef.name) - for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): + for _, (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) - report.resource_id = ( - f"{subject.kind}/{subject.name}" - if not subject.namespace - else f"{subject.kind}/{subject.namespace}/{subject.name}" - ) + report.resource_id = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to the node proxy sub-resource." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py index 58869fe9ae..1d83b684f5 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py @@ -15,19 +15,16 @@ class rbac_minimize_pv_creation_access(Check): subjects_bound_roles = {} for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: + # CIS benchmarks scope these checks to human identities only if subject.kind in ["User", "Group"]: key = (subject.kind, subject.name, subject.namespace) if key not in subjects_bound_roles: subjects_bound_roles[key] = (subject, set()) subjects_bound_roles[key][1].add(crb.roleRef.name) - for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): + for _, (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) - report.resource_id = ( - f"{subject.kind}/{subject.name}" - if not subject.namespace - else f"{subject.kind}/{subject.namespace}/{subject.name}" - ) + report.resource_id = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create PersistentVolumes." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py index 34b823a726..f34544fec7 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py @@ -15,19 +15,16 @@ class rbac_minimize_service_account_token_creation(Check): subjects_bound_roles = {} for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: + # CIS benchmarks scope these checks to human identities only if subject.kind in ["User", "Group"]: key = (subject.kind, subject.name, subject.namespace) if key not in subjects_bound_roles: subjects_bound_roles[key] = (subject, set()) subjects_bound_roles[key][1].add(crb.roleRef.name) - for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): + for _, (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) - report.resource_id = ( - f"{subject.kind}/{subject.name}" - if not subject.namespace - else f"{subject.kind}/{subject.namespace}/{subject.name}" - ) + report.resource_id = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py index e13c6e07ab..94a2fc10a9 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py @@ -18,19 +18,16 @@ class rbac_minimize_webhook_config_access(Check): subjects_bound_roles = {} for crb in rbac_client.cluster_role_bindings.values(): for subject in crb.subjects: + # CIS benchmarks scope these checks to human identities only if subject.kind in ["User", "Group"]: key = (subject.kind, subject.name, subject.namespace) if key not in subjects_bound_roles: subjects_bound_roles[key] = (subject, set()) subjects_bound_roles[key][1].add(crb.roleRef.name) - for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): + for _, (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) - report.resource_id = ( - f"{subject.kind}/{subject.name}" - if not subject.namespace - else f"{subject.kind}/{subject.namespace}/{subject.name}" - ) + report.resource_id = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create, update, or delete webhook configurations." for cr in rbac_client.cluster_roles.values():