stackrox / kube-linter

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.
https://docs.kubelinter.io/
Apache License 2.0
2.96k stars 233 forks source link

[BUG]: annotation `ignore-check.kube-linter.io/access-to-secrets` does not work #605

Closed kyubisation closed 1 year ago

kyubisation commented 1 year ago

System info:

Describe the bug kube-linter allows ignoring specific violations via annotation: https://docs.kubelinter.io/#/configuring-kubelinter?id=ignoring-violations-for-specific-cases This does not work for access-to-secrets in a role binding.

.helm-template-output.yaml: (object: <no namespace>/argocd-image-updater rbac.authorization.k8s.io/v1, Kind=RoleBinding) binding to "argocd-image-updater" role that has [get list watch] access to [secrets] (check: access-to-secrets, remediation: Where possible, remove get, list and watch access to secret objects in the cluster.)

To Reproduce Steps to reproduce the behavior:

Sample YAML input

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: argocd-image-updater
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - argoproj.io
  resources:
  - applications
  verbs:
  - get
  - list
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argocd-image-updater
  annotation:
    ignore-check.kube-linter.io/access-to-secrets: "Argo CD Image Updater needs access to secrets in the Argo CD namespace/project"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: argocd-image-updater
subjects:
- kind: ServiceAccount
  name: argocd-image-updater

Expected behavior The error should be suppressed.

Screenshots

-

Additional context

kyubisation commented 1 year ago

Unfortunately I'm apparently just unable to read and missed the s in annotation(s). Sorry about that.