asat

Documentation

Index

• Constants
• type AutomountServiceAccountToken
  • func New() *AutomountServiceAccountToken
  • func (a *AutomountServiceAccountToken) Audit(resource k8s.Resource, resources []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Constants

const (
	// AutomountServiceAccountTokenDeprecated occurs when the deprecated serviceAccount field is non-empty
	AutomountServiceAccountTokenDeprecated = "AutomountServiceAccountTokenDeprecated"
	// AutomountServiceAccountTokenTrueAndDefaultSA occurs when automountServiceAccountToken is either not set
	// (which defaults to true) or explicitly set to true, and serviceAccountName is either not set or set to "default"
	AutomountServiceAccountTokenTrueAndDefaultSA = "AutomountServiceAccountTokenTrueAndDefaultSA"
)

const Name = "asat"

const OverrideLabel = "allow-automount-service-account-token"

Types

type AutomountServiceAccountToken

type AutomountServiceAccountToken struct{}

AutomountServiceAccountToken implements Auditable

func New

func New() *AutomountServiceAccountToken

func (*AutomountServiceAccountToken) Audit

func (a *AutomountServiceAccountToken) Audit(resource k8s.Resource, resources []k8s.Resource) ([]*kubeaudit.AuditResult, error)

Audit checks that the deprecated serviceAccount field is not used and that the default service account is not being automatically mounted