Skip to content

Commit 71a366e

Browse files
committed
docs: update usage and add installation section
1 parent 5ae2b0e commit 71a366e

File tree

2 files changed

+19
-5
lines changed

2 files changed

+19
-5
lines changed

README.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@ For some use cases when a tight security access is required, users should only h
2828

2929
For example, you can use `kube-rbac-extractor` to limit the user's access to the kinds used in a specific Helm chart.
3030

31+
## Installation
32+
33+
Download pre-compiled binary from [GitHub releases](https://github.com/DevOpsHiveHQ/kube-rbac-extractor/releases) page, or use Docker image:
34+
35+
```
36+
ghcr.io/devopshivehq/kube-rbac-extractor:latest
37+
```
38+
3139
## Usage
3240

3341
```
@@ -37,11 +45,16 @@ Usage of kube-rbac-extractor:
3745
--cluster
3846
Generate ClusterRole instead of Role
3947
--extra-schema string
40-
Path to extra kinds schema RBAC JSON file for custom resources
48+
Path to extra kinds RBAC schema JSON file for custom resources
4149
--name string
4250
Metadata name for the Role/ClusterRole (default "access")
4351
--namespace string
4452
Namespace for Role (ignored for ClusterRole)
53+
--resource-names
54+
Include resourceNames from manifest metadata.name in the rules
55+
--role-binding-subjects string
56+
Generate RoleBinding/ClusterRoleBinding using comma-separated list of subjects to bind the role to
57+
(e.g., User:alice,Group:devs,ServiceAccount:ns:sa)
4558
```
4659

4760
## Example

main.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -332,10 +332,11 @@ func main() {
332332
namespace := flag.String("namespace", "", "Namespace for Role (ignored for ClusterRole)")
333333
extraSchemaPath := flag.String("extra-schema", "", "Path to extra kinds RBAC schema JSON file for custom resources")
334334
includeResourceNames := flag.Bool("resource-names", false, "Include resourceNames from manifest metadata.name in the rules")
335-
roleBindingSubjects := flag.String("role-binding-subjects", "", "Comma-separated list of subjects to bind the role to (e.g., User:alice,Group:devs,ServiceAccount:ns:sa)")
335+
generateRoleBindingSubjects := flag.String("role-binding-subjects", "",
336+
"Generate RoleBinding/ClusterRoleBinding using comma-separated list of subjects to bind the role to (e.g., User:alice,Group:devs,ServiceAccount:ns:sa)")
336337
flag.Parse()
337338

338-
sk, err := loadSchemaKindsRBAC(schemaKindsJSON, *extraSchemaPath)
339+
schemaKinds, err := loadSchemaKindsRBAC(schemaKindsJSON, *extraSchemaPath)
339340
if err != nil {
340341
fmt.Fprintf(os.Stderr, "failed to load kinds RBAC schema data: %v\n", err)
341342
os.Exit(1)
@@ -347,12 +348,12 @@ func main() {
347348
os.Exit(1)
348349
}
349350

350-
rules := parseManifests(string(input), sk, *access, *includeResourceNames)
351+
rules := parseManifests(string(input), schemaKinds, *access, *includeResourceNames)
351352

352353
roleKind := "Role"
353354
if *cluster {
354355
roleKind = "ClusterRole"
355356
}
356357

357-
outputRoleAndBinding(*cluster, *name, *namespace, rules, *roleBindingSubjects, roleKind)
358+
outputRoleAndBinding(*cluster, *name, *namespace, rules, *generateRoleBindingSubjects, roleKind)
358359
}

0 commit comments

Comments
 (0)