role_relationships

Documentation

Index

• Constants
• type AssumableIAMRole
• type AssumeIAMRoleReason
• type EKSCluster
  • func (m *EKSCluster) AnalyzeRoleRelationships() error
  • func (m *EKSCluster) AnalyzeRoleRelationshipsForIRSA() error
  • func (m *EKSCluster) AnalyzeRoleRelationshipsForPodIdentity() error
• type IAMRole
• type K8sPod
• type K8sServiceAccount
• type PodIdentityAssociation

Constants

const (
	AssumeIAMRoleReasonIRSA        = "IAM Roles for Service Accounts"
	AssumeIAMRoleReasonPodIdentity = "Pod Identity"
)

const PodIdentityMinSupportedK8sVersion = "1.24"

https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html#pod-id-cluster-versions

Types

type AssumableIAMRole

type AssumableIAMRole struct {
	IAMRole *IAMRole
	Reason  AssumeIAMRoleReason
}

AssumableIAMRole records that an IAM role can be assumed through a specific mechanism

type AssumeIAMRoleReason

type AssumeIAMRoleReason string

type EKSCluster

type EKSCluster struct {
	AwsClient *aws.Config
	K8sClient *kubernetes.Clientset

	Name                       string
	KubernetesVersion          string // e.g. "1.24"
	AccountID                  string
	IssuerURL                  string
	ServiceAccountsByNamespace map[string][]*K8sServiceAccount
	PodsByNamespace            map[string][]*K8sPod
	IAMRoles                   []*IAMRole
}

func (*EKSCluster) AnalyzeRoleRelationships

func (m *EKSCluster) AnalyzeRoleRelationships() error

func (*EKSCluster) AnalyzeRoleRelationshipsForIRSA

func (m *EKSCluster) AnalyzeRoleRelationshipsForIRSA() error

func (*EKSCluster) AnalyzeRoleRelationshipsForPodIdentity

func (m *EKSCluster) AnalyzeRoleRelationshipsForPodIdentity() error

type IAMRole

type IAMRole struct {
	Arn          string
	TrustPolicy  string
	IsPrivileged bool
}

type K8sPod

type K8sPod struct {
	Name                            string
	Namespace                       string
	ServiceAccount                  *K8sServiceAccount
	HasProjectedServiceAccountToken bool
}

type K8sServiceAccount

type K8sServiceAccount struct {
	Name           string
	Namespace      string
	Annotations    map[string]string
	AssumableRoles []*AssumableIAMRole
}

type PodIdentityAssociation

type PodIdentityAssociation struct {
	ID                 string
	Namespace          string
	ServiceAccountName string
	RoleArn            string
}