Compliance Automation and Tooling Questions

# namespaced role granting only read access to ConfigMaps
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: configmap-reader
  namespace: payments
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: payments-cm-reader-binding
  namespace: payments
subjects:
- kind: ServiceAccount
  name: payments-sa
roleRef:
  kind: Role
  name: configmap-reader
  apiGroup: rbac.authorization.k8s.io

package rbac.restrictions

deny[msg] {
  input.review.kind.kind == "Role" 
  some i
  r := input.review.object.rules[i]
  any_wildcard(r)
  msg := sprintf("Role %v contains wildcard verbs/resources", [input.review.object.metadata.name])
}

any_wildcard(r) {
  r.verbs[_] == "*"
}
any_wildcard(r) {
  r.resources[_] == "*"
}

deny[msg] {
  input.review.kind.kind == "ClusterRoleBinding"
  input.review.object.roleRef.name == "cluster-admin"
  msg := "Binding to cluster-admin is forbidden"
}