k8s_rbac_cluster_role resource

Use the k8s_rbac_cluster_role Chef InSpec audit resource to test the Role-based access control (RBAC) cluster role settings.

Installation

Syntax

describe k8s_rbac_cluster_role(name: "NAME") do
  #...
end

Parameters

name: Cluster role name.

Properties

uid: UID of the cluster role.
kind: Resource type of the cluster role.
resource_version: Resource version of the cluster role.
labels: Labels attached to the cluster role.
annotations: Annotations of the cluster role.
rules: List of rules set for the cluster role.
aggregation_rule: Aggregation rule set for the cluster role.
cluster_role_selectors: List of aggregation rule cluster role selectors set for the cluster role.
metadata: Metadata of the cluster role.
creation_timestamp: Creation timestamp of the cluster role.

Examples

Test to verify that the RBAC cluster role with the specified name exists

describe k8s_rbac_cluster_role(name: "CLUSTER_ROLE_NAME") do
  it { should exist }
end

Test to verify rules set for the specified cluster role

describe k8s_rbac_cluster_role(name: "pod-reader") do
  it { should exist }
  its('rules') { should  include apiGroups: [""], resources: ["pods"], verbs: ["get", "list", "watch"] }
end

Test to verify aggregation rule is not empty and cluster role selectors have the specified value

describe k8s_rbac_cluster_role(name: "monitoring") do
    its("aggregation_rule") { should_not be_empty }
    its("cluster_role_selectors") { should include matchLabels: { "rbac.example.com/aggregate-to-monitoring": "true" }  }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our Universal Matchers page.