Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Display namespace for ServiceAccount while running rbac-tool policy-rules -e default #112

Closed
fjammes opened this issue Jul 4, 2024 · 0 comments · Fixed by #113
Closed

Display namespace for ServiceAccount while running rbac-tool policy-rules -e default #112

fjammes opened this issue Jul 4, 2024 · 0 comments · Fixed by #113
Labels
good first issue Good for newcomers under review

Comments

@fjammes
Copy link
Contributor

fjammes commented Jul 4, 2024 •
edited
Loading

In the command below and on a large cluster there can be a lot of ServiceAccount named default which have different permissions, the current policy-rules command does not allow to know to which namespaces each of these service account belongs. Here is an example:

rbac-tool policy-rules -e default
  TYPE           | SUBJECT                                         | VERBS  | NAMESPACE   | API GROUP           | KIND                                  | NAMES                                                           | NONRESOURCEURI | ORIGINATED FROM                                                                 
-----------------+-------------------------------------------------+--------+-------------+---------------------+---------------------------------------+-----------------------------------------------------------------+----------------+---------------------------------------------------------------------------------
  Group          | system:bootstrappers:kubeadm:default-node-token | create | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  Group          | system:bootstrappers:kubeadm:default-node-token | create | *           | certificates.k8s.io | certificatesigningrequests/nodeclient |                                                                 |                | ClusterRoles>>system:certificates.k8s.io:certificatesigningrequests:nodeclient  
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | *           | core                | nodes                                 |                                                                 |                | ClusterRoles>>kubeadm:get-nodes                                                 
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | kube-system | core                | configmaps                            | kube-proxy                                                      |                | Roles>>kube-system/kube-proxy                                                   
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | kube-system | core                | configmaps                            | kubeadm-config                                                  |                | Roles>>kube-system/kubeadm:nodes-kubeadm-config                                 
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | kube-system | core                | configmaps                            | kubelet-config                                                  |                | Roles>>kube-system/kubeadm:kubelet-config                                       
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  Group          | system:bootstrappers:kubeadm:default-node-token | list   | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  Group          | system:bootstrappers:kubeadm:default-node-token | watch  | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  ServiceAccount | default                                         | *      | *           |                     |                                       |                                                                 | *              | ClusterRoles>>cluster-admin                                                     
  ServiceAccount | default                                         | *      | *           | *                   | *                                     |                                                                 |                | ClusterRoles>>cluster-admin                                                     
  ServiceAccount | default                                         | create | olm         | core                | configmaps                            | 5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155 |                | Roles>>olm/5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155      
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  ServiceAccount | default                                         | get    | olm         | core                | configmaps                            | 5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155 |                | Roles>>olm/5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155      
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  ServiceAccount | default                                         | update | olm         | core                | configmaps                            | 5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155 |                | Roles>>olm/5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155      
                 |                                                 |        |             |                     |                                       |                                                                 |                |

There is two default service account in two different namespace and the user interface does not display this information. This is confusing.

The implemented feature, will display the SUBJECT with the following format: "namespace:serviceAccountName".

Here is an example for the same cluster:

rbac-tool policy-rules -e default
  TYPE           | SUBJECT                                         | VERBS  | NAMESPACE   | API GROUP           | KIND                                  | NAMES                                                           | NONRESOURCEURI | ORIGINATED FROM                                                                 
-----------------+-------------------------------------------------+--------+-------------+---------------------+---------------------------------------+-----------------------------------------------------------------+----------------+---------------------------------------------------------------------------------
  Group          | system:bootstrappers:kubeadm:default-node-token | create | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  Group          | system:bootstrappers:kubeadm:default-node-token | create | *           | certificates.k8s.io | certificatesigningrequests/nodeclient |                                                                 |                | ClusterRoles>>system:certificates.k8s.io:certificatesigningrequests:nodeclient  
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | *           | core                | nodes                                 |                                                                 |                | ClusterRoles>>kubeadm:get-nodes                                                 
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | kube-system | core                | configmaps                            | kube-proxy                                                      |                | Roles>>kube-system/kube-proxy                                                   
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | kube-system | core                | configmaps                            | kubeadm-config                                                  |                | Roles>>kube-system/kubeadm:nodes-kubeadm-config                                 
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  Group          | system:bootstrappers:kubeadm:default-node-token | get    | kube-system | core                | configmaps                            | kubelet-config                                                  |                | Roles>>kube-system/kubeadm:kubelet-config                                       
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  Group          | system:bootstrappers:kubeadm:default-node-token | list   | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  Group          | system:bootstrappers:kubeadm:default-node-token | watch  | *           | certificates.k8s.io | certificatesigningrequests            |                                                                 |                | ClusterRoles>>system:node-bootstrapper                                          
  ServiceAccount | monitoring:default                              | *      | *           |                     |                                       |                                                                 | *              | ClusterRoles>>cluster-admin                                                     
  ServiceAccount | monitoring:default                              | *      | *           | *                   | *                                     |                                                                 |                | ClusterRoles>>cluster-admin                                                     
  ServiceAccount | olm:default                                     | create | olm         | core                | configmaps                            | 5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155 |                | Roles>>olm/5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155      
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  ServiceAccount | olm:default                                     | get    | olm         | core                | configmaps                            | 5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155 |                | Roles>>olm/5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155      
                 |                                                 |        |             |                     |                                       |                                                                 |                |                                                                                 
  ServiceAccount | olm:default                                     | update | olm         | core                | configmaps                            | 5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155 |                | Roles>>olm/5e5932a6bfa63515cdf4466e9d3d1442f14b290645ba0ee54de32b5c67d5155      
                 |                                                 |        |             |                     |                                       |                                                                 |                |
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue Good for newcomers under review
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Display namespace when SUBJECT is a ServiceAccount k8s-school/rbac-tool
2 participants
@fjammes @gadinaor-r7