feat: rbac config access

fixtures/data/k8s_rbac_access_test.json

@@ -0,0 +1,71 @@
+{
+  "id": "Kubernetes/test-cluster/Pod/default/nginx",
+  "config_class": "Pod",
+  "config": {
+    "apiVersion": "v1",
+    "kind": "Pod",
+    "metadata": {
+      "name": "nginx",
+      "namespace": "default"
+    }
+  },
+  "external_roles": [
+    {
+      "name": "pod-reader",
+      "account_id": "test-cluster",
+      "role_type": "ClusterRole",
+      "aliases": ["Kubernetes/test-cluster/ClusterRole//pod-reader"]
+    }
+  ],
+  "external_users": [
+    {
+      "name": "my-sa",
+      "account_id": "test-cluster",
+      "user_type": "ServiceAccount",
+      "aliases": ["Kubernetes/test-cluster/ServiceAccount/default/my-sa"]
+    },
+    {
+      "name": "admin@example.com",
+      "account_id": "test-cluster",
+      "user_type": "User",
+      "aliases": ["Kubernetes/test-cluster/User//admin@example.com"]
+    }
+  ],
+  "external_groups": [
+    {
+      "name": "system:authenticated",
+      "account_id": "test-cluster",
+      "group_type": "Group",
+      "aliases": ["Kubernetes/test-cluster/Group//system:authenticated"]
+    }
+  ],
+  "config_access": [
+    {
+      "id": "rbac-access-sa",
+      "external_config_id": {
+        "config_type": "Kubernetes::Pod",
+        "external_id": "Kubernetes/test-cluster/Pod/default/nginx"
+      },
+      "external_user_aliases": ["Kubernetes/test-cluster/ServiceAccount/default/my-sa"],
+      "external_role_aliases": ["Kubernetes/test-cluster/ClusterRole//pod-reader"]
+    },
+    {
+      "id": "rbac-access-user",
+      "external_config_id": {
+        "config_type": "Kubernetes::Pod",
+        "external_id": "Kubernetes/test-cluster/Pod/default/nginx"
+      },
+      "external_user_aliases": ["Kubernetes/test-cluster/User//admin@example.com"],
+      "external_role_aliases": ["Kubernetes/test-cluster/ClusterRole//pod-reader"]
+    },
+    {
+      "id": "rbac-access-group",
+      "external_config_id": {
+        "config_type": "Kubernetes::Pod",
+        "external_id": "Kubernetes/test-cluster/Pod/default/nginx"
+      },
+      "external_group_aliases": ["Kubernetes/test-cluster/Group//system:authenticated"],
+      "external_role_aliases": ["Kubernetes/test-cluster/ClusterRole//pod-reader"]
+    }
+  ]
+}

fixtures/file-k8s-rbac-access.yaml

@@ -0,0 +1,12 @@
+apiVersion: configs.flanksource.com/v1
+kind: ScrapeConfig
+metadata:
+  name: file-k8s-rbac-access-scraper
+spec:
+  full: true
+  file:
+    - type: Kubernetes::Pod
+      class: Pod
+      id: $.id
+      paths:
+        - fixtures/data/k8s_rbac_access_test.json

scrapers/extraction_unit_test.go

@@ -11,14 +11,14 @@ import (
 
 func TestExtractConfigAccess(t *testing.T) {
 	testCases := []struct {
-		name                  string
-		input                 map[string]any
-		expectError           bool
-		expectedCount         int
-		expectedIDs           []string
-		expectedUserAliases   [][]string
-		expectedRoleAliases   [][]string
-		expectedGroupAliases  [][]string
+		name                 string
+		input                map[string]any
+		expectError          bool
+		expectedCount        int
+		expectedIDs          []string
+		expectedUserAliases  [][]string
+		expectedRoleAliases  [][]string
+		expectedGroupAliases [][]string
 	}{
 		{
 			name: "extracts config_access with external_user_aliases",

scrapers/kubernetes/kubernetes.go

@@ -139,6 +139,13 @@ func ExtractResults(ctx *KubernetesContext, objs []*unstructured.Unstructured) v
 
 	results = append(results, cluster)
 
+	// Initialize RBAC extractor for config access tracking
+	rbacCtx := ctx.ScrapeContext
+	rbacCtx.Context = rbacCtx.WithKubernetes(ctx.config.KubernetesConnection)
+	rbac := newRBACExtractor(rbacCtx, clusterName, ctx.ScrapeConfig().GetPersistedID())
+	rbac.indexObjects(objs)
+	var roleBindings []*unstructured.Unstructured
+
 	ctx.Load(objs)
 	if ctx.IsIncrementalScrape() {
 		// On incremental scrape, we do not have all the data in the resource ID map.
@@ -419,6 +426,13 @@ func ExtractResults(ctx *KubernetesContext, objs []*unstructured.Unstructured) v
 					}
 				}
 			}
+
+		case "ClusterRole", "Role":
+			rbac.processRole(obj)
+
+		case "ClusterRoleBinding", "RoleBinding":
+			// Store bindings for later processing after all roles are processed
+			roleBindings = append(roleBindings, obj)
 		}
 
 		if obj.GetNamespace() != "" {
@@ -551,6 +565,12 @@ func ExtractResults(ctx *KubernetesContext, objs []*unstructured.Unstructured) v
 		})
 	}
 
+	// Process role bindings after all roles have been processed
+	for _, binding := range roleBindings {
+		rbac.processRoleBinding(binding)
+	}
+	results = append(results, rbac.results(ctx.config.BaseScraper))
+
 	results = append(results, changeResults...)
 	if ctx.IsIncrementalScrape() {
 		results = append([]v1.ScrapeResult{ctx.cluster}, results...)