-
Notifications
You must be signed in to change notification settings - Fork 115
/
binding-subject.go
81 lines (67 loc) · 2.39 KB
/
binding-subject.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
/*
Copyright 2021 Flant JSC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package roles
import (
v1 "k8s.io/api/rbac/v1"
"k8s.io/apimachinery/pkg/runtime"
"github.com/deckhouse/deckhouse/testing/matrix/linter/rules/errors"
"github.com/deckhouse/deckhouse/testing/matrix/linter/storage"
"github.com/deckhouse/deckhouse/testing/matrix/linter/utils"
)
func ObjectBindingSubjectServiceAccountCheck(m utils.Module, object storage.StoreObject, objectStore *storage.UnstructuredObjectStore) errors.LintRuleError {
if m.Name == "user-authz" {
return errors.EmptyRuleError
}
converter := runtime.DefaultUnstructuredConverter
var subjects []v1.Subject
// deckhouse module should contain only global cluster roles
objectKind := object.Unstructured.GetKind()
switch objectKind {
case "ClusterRoleBinding":
clusterRoleBinding := new(v1.ClusterRoleBinding)
err := converter.FromUnstructured(object.Unstructured.UnstructuredContent(), clusterRoleBinding)
if err != nil {
panic(err)
}
subjects = clusterRoleBinding.Subjects
case "RoleBinding":
roleBinding := new(v1.RoleBinding)
err := converter.FromUnstructured(object.Unstructured.UnstructuredContent(), roleBinding)
if err != nil {
panic(err)
}
subjects = roleBinding.Subjects
default:
return errors.EmptyRuleError
}
for _, subject := range subjects {
if subject.Kind != "ServiceAccount" {
continue
}
// Prometheus service account has bindings across modules to scrape metrics.
if subject.Name == "prometheus" && subject.Namespace == "d8-monitoring" {
continue
}
if subject.Namespace == m.Namespace && !objectStore.Exists(storage.ResourceIndex{
Name: subject.Name, Kind: subject.Kind, Namespace: subject.Namespace,
}) {
return errors.NewLintRuleError(
"MANIFEST054",
object.Identity(),
subject.Name,
"%s bind to the wrong ServiceAccount (doesn't exist in the store)", objectKind,
)
}
}
return errors.EmptyRuleError
}