Control: ClusterRoles permissions for managing the configuration of validation or mutation admission webhooks should be minimized

powerpipe control run kubernetes_compliance.control.cluster_role_with_validating_or_mutating_admission_webhook_configurations

powerpipe login
powerpipe control run kubernetes_compliance.control.cluster_role_with_validating_or_mutating_admission_webhook_configurations --share

with role_with_escalate as (
  select
    uid,
    count(*) as num
  from
    kubernetes_cluster_role,
    jsonb_array_elements(rules) rule
  where
    rule -> 'apiGroups' @> '["admissionregistration.k8s.io"]'
    and (
      rule -> 'resources' @> '["mutatingwebhookconfigurations"]'
      or rule -> 'resources' @> '["validatingwebhookconfigurations"]'
    )
    and rule -> 'verbs' @> '["create", "update", "patch"]'
  group by
    uid
)
select
  coalesce(r.uid, concat(r.path, ':', r.start_line)) as resource,
  case
    when e.num > 0 then 'alarm'
    else 'ok'
  end as status,
  case
    when e.num > 0  then name || ' contains ' || e.num || ' RBAC cluster role validating or mutating admission webhook configurations permissions.'
    else name || ' does not contain any bind role bindings or cluster role validating or mutating admission webhook configurations permissions.'
  end as reason,
  name as role_name
  
  , coalesce(context_name, '') as context_name, source_type, coalesce(path || ':' || start_line || '-' || end_line, '') as path
from
  kubernetes_cluster_role as r
  left join role_with_escalate as e on e.uid = r.uid;