From a1bc9abf21711b2f8de333fda20edb426d8dd512 Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Wed, 4 Mar 2026 08:13:31 +0100 Subject: [PATCH] fix(k8s): disambiguate RBAC findings by prefixing resource_id with subject kind - Override resource_id and resource_name to "kind/name" format in all five deduplicated RBAC checks so User and Group with the same name produce distinct findings --- .../rbac_minimize_csr_approval_access.py | 2 ++ .../rbac_minimize_node_proxy_subresource_access.py | 2 ++ .../rbac_minimize_pv_creation_access.py | 2 ++ .../rbac_minimize_service_account_token_creation.py | 2 ++ .../rbac_minimize_webhook_config_access.py | 2 ++ 5 files changed, 10 insertions(+) diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py index 9a554d65cc..5533086571 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_csr_approval_access/rbac_minimize_csr_approval_access.py @@ -23,6 +23,8 @@ class rbac_minimize_csr_approval_access(Check): for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) + report.resource_id = f"{subject.kind}/{subject.name}" + report.resource_name = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to update the CSR approval sub-resource." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py index 3ee59070e3..9d42993adf 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_node_proxy_subresource_access/rbac_minimize_node_proxy_subresource_access.py @@ -23,6 +23,8 @@ class rbac_minimize_node_proxy_subresource_access(Check): for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) + report.resource_id = f"{subject.kind}/{subject.name}" + report.resource_name = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to the node proxy sub-resource." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py index 4b675a5c42..85f018a3cd 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_pv_creation_access/rbac_minimize_pv_creation_access.py @@ -23,6 +23,8 @@ class rbac_minimize_pv_creation_access(Check): for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) + report.resource_id = f"{subject.kind}/{subject.name}" + report.resource_name = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create PersistentVolumes." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py index 59d88cdc14..241bcf2411 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_service_account_token_creation/rbac_minimize_service_account_token_creation.py @@ -23,6 +23,8 @@ class rbac_minimize_service_account_token_creation(Check): for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) + report.resource_id = f"{subject.kind}/{subject.name}" + report.resource_name = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create service account tokens." for cr in rbac_client.cluster_roles.values(): diff --git a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py index 1b680307a8..3cb5ac4737 100644 --- a/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py +++ b/prowler/providers/kubernetes/services/rbac/rbac_minimize_webhook_config_access/rbac_minimize_webhook_config_access.py @@ -26,6 +26,8 @@ class rbac_minimize_webhook_config_access(Check): for (_kind, _name, _ns), (subject, role_names) in subjects_bound_roles.items(): report = Check_Report_Kubernetes(metadata=self.metadata(), resource=subject) + report.resource_id = f"{subject.kind}/{subject.name}" + report.resource_name = f"{subject.kind}/{subject.name}" report.status = "PASS" report.status_extended = f"User or group '{subject.name}' does not have access to create, update, or delete webhook configurations." for cr in rbac_client.cluster_roles.values():