fix(k8s): disambiguate RBAC findings by prefixing resource_id with subject kind

- Override resource_id and resource_name to "kind/name" format in all five
  deduplicated RBAC checks so User and Group with the same name produce
  distinct findings
This commit is contained in:
Andoni A. committed 2026-03-04 08:13:31 +01:00
1 parent e489ffc8c7
commit a1bc9abf21
5 files changed
+10

No files matched your search

@@ -23,6 +23,8 @@ class rbac_minimize_csr_approval_access(Check):
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
report.resource_id = f"{subject.kind}/{subject.name}"
report.resource_name = f"{subject.kind}/{subject.name}"
report.status = "PASS"
report.status_extended = f"User or group '{subject.name}' does not have access to update the CSR approval sub-resource."
for cr in rbac_client.cluster_roles.values():
@@ -23,6 +23,8 @@ class rbac_minimize_node_proxy_subresource_access(Check):
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
report.resource_id = f"{subject.kind}/{subject.name}"
report.resource_name = f"{subject.kind}/{subject.name}"
report.status = "PASS"
report.status_extended = f"User or group '{subject.name}' does not have access to the node proxy sub-resource."
for cr in rbac_client.cluster_roles.values():
@@ -23,6 +23,8 @@ class rbac_minimize_pv_creation_access(Check):
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
report.resource_id = f"{subject.kind}/{subject.name}"
report.resource_name = f"{subject.kind}/{subject.name}"
report.status = "PASS"
report.status_extended = f"User or group '{subject.name}' does not have access to create PersistentVolumes."
for cr in rbac_client.cluster_roles.values():
@@ -23,6 +23,8 @@ class rbac_minimize_service_account_token_creation(Check):
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
report.resource_id = f"{subject.kind}/{subject.name}"
report.resource_name = f"{subject.kind}/{subject.name}"
report.status = "PASS"
report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens."
for cr in rbac_client.cluster_roles.values():
@@ -26,6 +26,8 @@ class rbac_minimize_webhook_config_access(Check):
for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items():
report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject)
report.resource_id = f"{subject.kind}/{subject.name}"
report.resource_name = f"{subject.kind}/{subject.name}"
report.status = "PASS"
report.status_extended = f"User or group '{subject.name}' does not have access to create, update, or delete webhook configurations."
for cr in rbac_client.cluster_roles.values():