popeye
popeye copied to clipboard
Parts of aggregated ClusterRoles are being highlighted as unused
Describe the bug
ClusterRoles that are being aggregated to a another one, they appear unused in the report (POP-400)
To Reproduce
Using
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
name: demo-main
aggregationRule:
clusterRoleSelectors:
- matchLabels:
rbac.authorization.k8s.io/aggregate-to-demo: "true"
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
rbac.authorization.k8s.io/aggregate-to-demo: "true"
name: demo-part
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- list
Will appear unused, although it's being "used" by the ClusterRole that is being aggregated to (demo-main)
Expected behavior
ClusterRoles that are part of another ClusterRole shouldn't be highlighted
Versions (please complete the following information):
- Popeye 0.21.3
Additional context https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles