krane
krane copied to clipboard
[EPIC] Expand base commands set
This is to cover further RBAC inspection. The list below is just an indicator and some ideas around how to make it come complete (individual commands will link to separate issues):
-
unused
- #11 - Unused ClusterRole, ClusterRoleBinding, Role, RoleBinding -
multi-binding
- #12 - Show all roles for given subject and highlight those with multiple bindings for the same role. -
risky-roles
- #13 - List Roles/ClusterRoles for Subject (user, group or service account) with a SCOPE (Cluster-Wide/NS) -
risky-subjects
- #14 - Identify risky Subjects (Users, Groups and ServiceAccounts) -
roles
- #15 - List Roles/ClusterRoles for Subject (user, group or service account) with a SCOPE (Cluster-Wide/NS). Alternatively split command intousers
/serviceaccounts
/groups
? -
permissions
- #16 - List Rules (compiled permissions) for given Subject (user, group, sa) in scanned Kubernetes cluster - scoped by Cluster-Wide/NS?