rbac

Documentation

Index

• func EvaluateAutomountTokens(client corev1typed.CoreV1Interface, put *provider.Pod) (bool, string)
• type CrdResource
  • func GetCrdResources(crds []*apiextv1.CustomResourceDefinition) (resourceList []CrdResource)
• type RoleResource
• type RoleRule
  • func FilterRulesNonMatchingResources(ruleList []RoleRule, resourceList []CrdResource) (matching, nonMatching []RoleRule)
  • func GetAllRules(aRole *rbacv1.Role) (ruleList []RoleRule)
  • func SliceDifference(s1, s2 []RoleRule) (diff []RoleRule)

Functions

func EvaluateAutomountTokens

func EvaluateAutomountTokens(client corev1typed.CoreV1Interface, put *provider.Pod) (bool, string)

EvaluateAutomountTokens evaluates whether the automountServiceAccountToken is correctly configured for the given Pod. Checks if the token is explicitly set in the Pod's spec or if it is inherited from the associated ServiceAccount. Returns:

• bool: Indicates whether the Pod passed all checks. if yes- return true, otherwise return false.
• string: Error message if the Pod is misconfigured, otherwise an empty string.

Types

type CrdResource

type CrdResource struct {
	Group, SingularName, PluralName string
	ShortNames                      []string
}

func GetCrdResources

func GetCrdResources(crds []*apiextv1.CustomResourceDefinition) (resourceList []CrdResource)

GetCrdResources converts a list of apiextv1.CustomResourceDefinition structs into a list of list of CrdResource structs. Returns:

• []CrdResource : a slice of CrdResource objects.

type RoleResource

type RoleResource struct {
	Group, Name string
}

type RoleRule

type RoleRule struct {
	Resource RoleResource
	Verb     string
}

func FilterRulesNonMatchingResources

func FilterRulesNonMatchingResources(ruleList []RoleRule, resourceList []CrdResource) (matching, nonMatching []RoleRule)

FilterRulesNonMatchingResources filters RoleRules based on whether they match any CrdResource in the resourceList. Returns :

• Matching: a slice of RoleRule that contains all rules where a CrdResource matches a RoleRule based on their properties.
• NonMatching: a slice of RoleRule that contains all rules not matching the CRD resource.

func GetAllRules

func GetAllRules(aRole *rbacv1.Role) (ruleList []RoleRule)

GetAllRules retrieves a list all of rules defined by the role passed in input. Returns:

• []RoleRule : a slice of RoleRule objects.

func SliceDifference

func SliceDifference(s1, s2 []RoleRule) (diff []RoleRule)

SliceDifference checks if there is a difference between s1 and s2 RoleRule slices. Returns :

• []RoleRule : the elements that are exist in s1 but not in s2.