Skip to content

Commit 632942e

Browse files
BorisShekBorisShek
committed
#2621 Rename ClusterRole and ClusterRoleBinding
Rename the ClusterRole 'manager-role' and ClusterRoleBinding 'manager-rolebinding' to 'securecodebox-manager-role' and 'securecodebox-manager-rolebinding', respectively, because the original names are too generic and could collide with other projects in the same cluster. Signed-off-by: Boris Shek <boris.shek@iteratec.com>
1 parent 0d0c796 commit 632942e

7 files changed

Lines changed: 38 additions & 38 deletions

File tree

‎operator/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ help: ## Display this help.
6161

6262
.PHONY: manifests
6363
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
64-
$(CONTROLLER_GEN) rbac:roleName="manager-role",headerFile="hack/boilerplate.yaml.txt" crd:maxDescLen=256,headerFile="hack/boilerplate.yaml.txt" webhook paths="./..." output:crd:artifacts:config=crds output:rbac:artifacts:config=templates/rbac
64+
$(CONTROLLER_GEN) rbac:roleName="securecodebox-manager-role",headerFile="hack/boilerplate.yaml.txt" crd:maxDescLen=256,headerFile="hack/boilerplate.yaml.txt" webhook paths="./..." output:crd:artifacts:config=crds output:rbac:artifacts:config=templates/rbac
6565

6666
.PHONY: generate
6767
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.

‎operator/templates/rbac/role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
apiVersion: rbac.authorization.k8s.io/v1
66
kind: ClusterRole
77
metadata:
8-
name: manager-role
8+
name: securecodebox-manager-role
99
rules:
1010
- apiGroups:
1111
- ""

‎operator/templates/rbac/role_binding.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@
55
apiVersion: rbac.authorization.k8s.io/v1
66
kind: ClusterRoleBinding
77
metadata:
8-
name: manager-rolebinding
8+
name: securecodebox-manager-rolebinding
99
roleRef:
1010
apiGroup: rbac.authorization.k8s.io
1111
kind: ClusterRole
12-
name: manager-role
12+
name: securecodebox-manager-role
1313
subjects:
1414
- kind: ServiceAccount
1515
name: {{.Values.serviceAccount.name}}

‎operator/tests/__snapshot__/operator_test.yaml.snap‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ matches the snapshot:
271271
apiVersion: rbac.authorization.k8s.io/v1
272272
kind: ClusterRole
273273
metadata:
274-
name: manager-role
274+
name: securecodebox-manager-role
275275
rules:
276276
- apiGroups:
277277
- ""
@@ -370,11 +370,11 @@ matches the snapshot:
370370
apiVersion: rbac.authorization.k8s.io/v1
371371
kind: ClusterRoleBinding
372372
metadata:
373-
name: manager-rolebinding
373+
name: securecodebox-manager-rolebinding
374374
roleRef:
375375
apiGroup: rbac.authorization.k8s.io
376376
kind: ClusterRole
377-
name: manager-role
377+
name: securecodebox-manager-role
378378
subjects:
379379
- kind: ServiceAccount
380380
name: securecodebox-operator
@@ -848,7 +848,7 @@ properly-renders-the-service-monitor-when-enabled:
848848
apiVersion: rbac.authorization.k8s.io/v1
849849
kind: ClusterRole
850850
metadata:
851-
name: manager-role
851+
name: securecodebox-manager-role
852852
rules:
853853
- apiGroups:
854854
- ""
@@ -947,11 +947,11 @@ properly-renders-the-service-monitor-when-enabled:
947947
apiVersion: rbac.authorization.k8s.io/v1
948948
kind: ClusterRoleBinding
949949
metadata:
950-
name: manager-rolebinding
950+
name: securecodebox-manager-rolebinding
951951
roleRef:
952952
apiGroup: rbac.authorization.k8s.io
953953
kind: ClusterRole
954-
name: manager-role
954+
name: securecodebox-manager-role
955955
subjects:
956956
- kind: ServiceAccount
957957
name: securecodebox-operator

‎scanners/trivy/parser/__snapshots__/parser.test.js.snap‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -100044,7 +100044,7 @@ and the severity is therefore considered low.",
100044100044
{
100045100045
"attributes": {
100046100046
"fixedVersion": undefined,
100047-
"foundIn": "Target: 'ClusterRole/manager-role' / Class: 'config' / Type: 'kubernetes'",
100047+
"foundIn": "Target: 'ClusterRole/securecodebox-manager-role' / Class: 'config' / Type: 'kubernetes'",
100048100048
"id": "KSV048",
100049100049
"installedVersion": undefined,
100050100050
"packageName": undefined,
@@ -100055,7 +100055,7 @@ and the severity is therefore considered low.",
100055100055
},
100056100056
"category": "Misconfiguration",
100057100057
"description": "Check whether role permits update/create of a malicious pod",
100058-
"location": "scb://trivy/?Kind=ClusterRole&Name=manager-role",
100058+
"location": "scb://trivy/?Kind=ClusterRole&Name=securecodebox-manager-role",
100059100059
"mitigation": "Create a role which does not permit update/create of a malicious pod",
100060100060
"name": "Do not allow update/create of a malicious pod(Role permits create/update of a malicious pod)",
100061100061
"references": [
@@ -100073,7 +100073,7 @@ and the severity is therefore considered low.",
100073100073
{
100074100074
"attributes": {
100075100075
"fixedVersion": undefined,
100076-
"foundIn": "Target: 'ClusterRole/manager-role' / Class: 'config' / Type: 'kubernetes'",
100076+
"foundIn": "Target: 'ClusterRole/securecodebox-manager-role' / Class: 'config' / Type: 'kubernetes'",
100077100077
"id": "KSV050",
100078100078
"installedVersion": undefined,
100079100079
"packageName": undefined,
@@ -100084,9 +100084,9 @@ and the severity is therefore considered low.",
100084100084
},
100085100085
"category": "Misconfiguration",
100086100086
"description": "An effective level of access equivalent to cluster-admin should not be provided.",
100087-
"location": "scb://trivy/?Kind=ClusterRole&Name=manager-role",
100087+
"location": "scb://trivy/?Kind=ClusterRole&Name=securecodebox-manager-role",
100088100088
"mitigation": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
100089-
"name": "Do not allow management of RBAC resources(ClusterRole 'manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
100089+
"name": "Do not allow management of RBAC resources(ClusterRole 'securecodebox-manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
100090100090
"references": [
100091100091
{
100092100092
"type": "URL",
@@ -100102,7 +100102,7 @@ and the severity is therefore considered low.",
100102100102
{
100103100103
"attributes": {
100104100104
"fixedVersion": undefined,
100105-
"foundIn": "Target: 'ClusterRole/manager-role' / Class: 'config' / Type: 'kubernetes'",
100105+
"foundIn": "Target: 'ClusterRole/securecodebox-manager-role' / Class: 'config' / Type: 'kubernetes'",
100106100106
"id": "KSV050",
100107100107
"installedVersion": undefined,
100108100108
"packageName": undefined,
@@ -100113,9 +100113,9 @@ and the severity is therefore considered low.",
100113100113
},
100114100114
"category": "Misconfiguration",
100115100115
"description": "An effective level of access equivalent to cluster-admin should not be provided.",
100116-
"location": "scb://trivy/?Kind=ClusterRole&Name=manager-role",
100116+
"location": "scb://trivy/?Kind=ClusterRole&Name=securecodebox-manager-role",
100117100117
"mitigation": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
100118-
"name": "Do not allow management of RBAC resources(ClusterRole 'manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
100118+
"name": "Do not allow management of RBAC resources(ClusterRole 'securecodebox-manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
100119100119
"references": [
100120100120
{
100121100121
"type": "URL",
@@ -152880,7 +152880,7 @@ and the severity is therefore considered low.",
152880152880
{
152881152881
"attributes": {
152882152882
"fixedVersion": undefined,
152883-
"foundIn": "Target: 'ClusterRole/manager-role' / Class: 'config' / Type: 'kubernetes'",
152883+
"foundIn": "Target: 'ClusterRole/securecodebox-manager-role' / Class: 'config' / Type: 'kubernetes'",
152884152884
"id": "KSV048",
152885152885
"installedVersion": undefined,
152886152886
"packageName": undefined,
@@ -152891,7 +152891,7 @@ and the severity is therefore considered low.",
152891152891
},
152892152892
"category": "Misconfiguration",
152893152893
"description": "Check whether role permits update/create of a malicious pod",
152894-
"location": "scb://trivy/?Kind=ClusterRole&Name=manager-role",
152894+
"location": "scb://trivy/?Kind=ClusterRole&Name=securecodebox-manager-role",
152895152895
"mitigation": "Create a role which does not permit update/create of a malicious pod",
152896152896
"name": "Do not allow update/create of a malicious pod(Role permits create/update of a malicious pod)",
152897152897
"references": [
@@ -152909,7 +152909,7 @@ and the severity is therefore considered low.",
152909152909
{
152910152910
"attributes": {
152911152911
"fixedVersion": undefined,
152912-
"foundIn": "Target: 'ClusterRole/manager-role' / Class: 'config' / Type: 'kubernetes'",
152912+
"foundIn": "Target: 'ClusterRole/securecodebox-manager-role' / Class: 'config' / Type: 'kubernetes'",
152913152913
"id": "KSV050",
152914152914
"installedVersion": undefined,
152915152915
"packageName": undefined,
@@ -152920,9 +152920,9 @@ and the severity is therefore considered low.",
152920152920
},
152921152921
"category": "Misconfiguration",
152922152922
"description": "An effective level of access equivalent to cluster-admin should not be provided.",
152923-
"location": "scb://trivy/?Kind=ClusterRole&Name=manager-role",
152923+
"location": "scb://trivy/?Kind=ClusterRole&Name=securecodebox-manager-role",
152924152924
"mitigation": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
152925-
"name": "Do not allow management of RBAC resources(ClusterRole 'manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
152925+
"name": "Do not allow management of RBAC resources(ClusterRole 'securecodebox-manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
152926152926
"references": [
152927152927
{
152928152928
"type": "URL",
@@ -152938,7 +152938,7 @@ and the severity is therefore considered low.",
152938152938
{
152939152939
"attributes": {
152940152940
"fixedVersion": undefined,
152941-
"foundIn": "Target: 'ClusterRole/manager-role' / Class: 'config' / Type: 'kubernetes'",
152941+
"foundIn": "Target: 'ClusterRole/securecodebox-manager-role' / Class: 'config' / Type: 'kubernetes'",
152942152942
"id": "KSV050",
152943152943
"installedVersion": undefined,
152944152944
"packageName": undefined,
@@ -152949,9 +152949,9 @@ and the severity is therefore considered low.",
152949152949
},
152950152950
"category": "Misconfiguration",
152951152951
"description": "An effective level of access equivalent to cluster-admin should not be provided.",
152952-
"location": "scb://trivy/?Kind=ClusterRole&Name=manager-role",
152952+
"location": "scb://trivy/?Kind=ClusterRole&Name=securecodebox-manager-role",
152953152953
"mitigation": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
152954-
"name": "Do not allow management of RBAC resources(ClusterRole 'manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
152954+
"name": "Do not allow management of RBAC resources(ClusterRole 'securecodebox-manager-role' should not have access to resources ["roles", "rolebindings"] for verbs ["create", "update", "delete", "deletecollection", "impersonate", "*"])",
152955152955
"references": [
152956152956
{
152957152957
"type": "URL",

‎scanners/trivy/parser/__testFiles__/local-k8s-scan-result.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46802,10 +46802,10 @@
4680246802
},
4680346803
{
4680446804
"Kind": "ClusterRole",
46805-
"Name": "manager-role",
46805+
"Name": "securecodebox-manager-role",
4680646806
"Results": [
4680746807
{
46808-
"Target": "ClusterRole/manager-role",
46808+
"Target": "ClusterRole/securecodebox-manager-role",
4680946809
"Class": "config",
4681046810
"Type": "kubernetes",
4681146811
"Packages": [],
@@ -46940,7 +46940,7 @@
4694046940
"AVDID": "AVD-KSV-0050",
4694146941
"Title": "Do not allow management of RBAC resources",
4694246942
"Description": "An effective level of access equivalent to cluster-admin should not be provided.",
46943-
"Message": "ClusterRole 'manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
46943+
"Message": "ClusterRole 'securecodebox-manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
4694446944
"Namespace": "builtin.kubernetes.KSV050",
4694546945
"Query": "data.builtin.kubernetes.KSV050.deny",
4694646946
"Resolution": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
@@ -47050,7 +47050,7 @@
4705047050
"AVDID": "AVD-KSV-0050",
4705147051
"Title": "Do not allow management of RBAC resources",
4705247052
"Description": "An effective level of access equivalent to cluster-admin should not be provided.",
47053-
"Message": "ClusterRole 'manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
47053+
"Message": "ClusterRole 'securecodebox-manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
4705447054
"Namespace": "builtin.kubernetes.KSV050",
4705547055
"Query": "data.builtin.kubernetes.KSV050.deny",
4705647056
"Resolution": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
@@ -65501,10 +65501,10 @@
6550165501
},
6550265502
{
6550365503
"Kind": "ClusterRoleBinding",
65504-
"Name": "manager-rolebinding",
65504+
"Name": "securecodebox-manager-rolebinding",
6550565505
"Results": [
6550665506
{
65507-
"Target": "ClusterRoleBinding/manager-rolebinding",
65507+
"Target": "ClusterRoleBinding/securecodebox-manager-rolebinding",
6550865508
"Class": "config",
6550965509
"Type": "kubernetes",
6551065510
"Packages": [],

‎scanners/trivy/parser/__testFiles__/trivy--k8s-scan-results.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46909,10 +46909,10 @@
4690946909
},
4691046910
{
4691146911
"Kind": "ClusterRole",
46912-
"Name": "manager-role",
46912+
"Name": "securecodebox-manager-role",
4691346913
"Results": [
4691446914
{
46915-
"Target": "ClusterRole/manager-role",
46915+
"Target": "ClusterRole/securecodebox-manager-role",
4691646916
"Class": "config",
4691746917
"Type": "kubernetes",
4691846918
"Packages": [],
@@ -47047,7 +47047,7 @@
4704747047
"AVDID": "AVD-KSV-0050",
4704847048
"Title": "Do not allow management of RBAC resources",
4704947049
"Description": "An effective level of access equivalent to cluster-admin should not be provided.",
47050-
"Message": "ClusterRole 'manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
47050+
"Message": "ClusterRole 'securecodebox-manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
4705147051
"Namespace": "builtin.kubernetes.KSV050",
4705247052
"Query": "data.builtin.kubernetes.KSV050.deny",
4705347053
"Resolution": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
@@ -47157,7 +47157,7 @@
4715747157
"AVDID": "AVD-KSV-0050",
4715847158
"Title": "Do not allow management of RBAC resources",
4715947159
"Description": "An effective level of access equivalent to cluster-admin should not be provided.",
47160-
"Message": "ClusterRole 'manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
47160+
"Message": "ClusterRole 'securecodebox-manager-role' should not have access to resources [\"roles\", \"rolebindings\"] for verbs [\"create\", \"update\", \"delete\", \"deletecollection\", \"impersonate\", \"*\"]",
4716147161
"Namespace": "builtin.kubernetes.KSV050",
4716247162
"Query": "data.builtin.kubernetes.KSV050.deny",
4716347163
"Resolution": "Remove write permission verbs for resource 'roles' and 'rolebindings'",
@@ -53300,10 +53300,10 @@
5330053300
},
5330153301
{
5330253302
"Kind": "ClusterRoleBinding",
53303-
"Name": "manager-rolebinding",
53303+
"Name": "securecodebox-manager-rolebinding",
5330453304
"Results": [
5330553305
{
53306-
"Target": "ClusterRoleBinding/manager-rolebinding",
53306+
"Target": "ClusterRoleBinding/securecodebox-manager-rolebinding",
5330753307
"Class": "config",
5330853308
"Type": "kubernetes",
5330953309
"Packages": [],

0 commit comments

Comments
 (0)