fix(kubescape): make C-0015 secret-list exceptions take effect#2442
Conversation
C-0015 ("List Kubernetes secrets") reported 0/50 passing: its only
exception sat under a namespaceSelector, which Kubescape cannot apply to
RBAC-based findings (keyed on the Role/ClusterRole/binding, not a
namespace), so every secret-reader — including legitimate ones like
cert-manager — stayed flagged.
Move C-0015 to a dedicated secret-reader-rbac.yaml matching the ~65
legitimate secret-reading controllers/operators/databases by their RBAC
object (the proven wildcard-rbac.yaml kind+name pattern), remove the inert
entry from controller-rbac.yaml, and mirror the change into the Headlamp
exceptions ConfigMap. Genuinely over-privileged/admin identities (unused
tenant `edit` SAs, crossview's wildcard read, the cluster-admin/crossplane
admin groups) are deliberately left flagged so the control keeps working.
Scanner-suppression only — grants and removes no privileges. Validated:
ksail workload validate (local + prod, 500 files each); new CSE passes the
live Kubescape CRD schema.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughMoves the Kubescape C-0015 posture exception out of Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…5-secret-reader-exception # Conflicts: # k8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yaml
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml (2)
731-758: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winCrossplane provider ClusterRole names are pinned to a literal hash suffix.
Entries at lines 731-737, 738-744, 745-751, and 752-758 match
attributes.nameagainst a fixed hash (provider-aws-iam-ae66959c4138,provider-family-aws-1bcdce25f1e9,provider-upjet-github-04d509bb9f6f,provider-upjet-unifi-553bd95aeec2). These names include a generated hash that changes on provider re-installs/revisions, andattributes.namehere is evaluated withregexCompare, so the exception should use an anchored regex covering the stable prefix plus hash pattern instead of the current literal hash.Based on learnings from a prior review in this repo: "For Kubescape ClusterSecurityException ... and the mirrored Headlamp exception config, do NOT pin
spec.match.resources[].name(and Headlampattributes.name) to a single literal value when the identifier includes a generated hash ... match such resources with an anchored regular expression that covers the stable prefix and the hash pattern (e.g.,^crossplane:provider:provider-upjet-github-[0-9a-f]+:system$)."🔧 Proposed fix
{ "designatorType": "Attributes", "attributes": { "kind": "^ClusterRole$", - "name": "^crossplane:provider:provider-aws-iam-ae66959c4138:system$" + "name": "^crossplane:provider:provider-aws-iam-[0-9a-f]+:system$" } }, { "designatorType": "Attributes", "attributes": { "kind": "^ClusterRole$", - "name": "^crossplane:provider:provider-family-aws-1bcdce25f1e9:system$" + "name": "^crossplane:provider:provider-family-aws-[0-9a-f]+:system$" } }, { "designatorType": "Attributes", "attributes": { "kind": "^ClusterRole$", - "name": "^crossplane:provider:provider-upjet-github-04d509bb9f6f:system$" + "name": "^crossplane:provider:provider-upjet-github-[0-9a-f]+:system$" } }, { "designatorType": "Attributes", "attributes": { "kind": "^ClusterRole$", - "name": "^crossplane:provider:provider-upjet-unifi-553bd95aeec2:system$" + "name": "^crossplane:provider:provider-upjet-unifi-[0-9a-f]+:system$" } },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml` around lines 731 - 758, The Crossplane provider ClusterRole exception entries are pinned to exact hash-suffixed names, which can break after re-installs or revisions. Update the affected `attributes.name` matches in the Headlamp exception config to use anchored regex patterns with the stable provider prefix plus a hash wildcard, following the existing `regexCompare`-style matching used for `ClusterRole` designators. Keep the same exception entries for the provider-aws-iam, provider-family-aws, provider-upjet-github, and provider-upjet-unifi roles, but replace each literal hash suffix with a flexible pattern so the match survives regenerated names.Source: Learnings
520-989: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winMirror the Crossplane provider matchers here with anchored regexes — these entries still hardcode the full provider names, so new hash suffixes will fall out of the exception list unless this CR stays in lockstep with the ConfigMap.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml` around lines 520 - 989, The secret-reader-rbac exception list in the kubescape config map is too specific for Crossplane provider roles, so new provider hash suffixes will stop matching. Update the Crossplane-related resource matchers in the secret-reader-rbac policy to use anchored regex patterns that match the provider role prefix rather than hardcoded full names, keeping the existing exception intent while making it resilient to future provider renames. Use the existing secret-reader-rbac policy entry and the Crossplane provider matchers as the place to update.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml`:
- Around line 731-758: The Crossplane provider ClusterRole exception entries are
pinned to exact hash-suffixed names, which can break after re-installs or
revisions. Update the affected `attributes.name` matches in the Headlamp
exception config to use anchored regex patterns with the stable provider prefix
plus a hash wildcard, following the existing `regexCompare`-style matching used
for `ClusterRole` designators. Keep the same exception entries for the
provider-aws-iam, provider-family-aws, provider-upjet-github, and
provider-upjet-unifi roles, but replace each literal hash suffix with a flexible
pattern so the match survives regenerated names.
- Around line 520-989: The secret-reader-rbac exception list in the kubescape
config map is too specific for Crossplane provider roles, so new provider hash
suffixes will stop matching. Update the Crossplane-related resource matchers in
the secret-reader-rbac policy to use anchored regex patterns that match the
provider role prefix rather than hardcoded full names, keeping the existing
exception intent while making it resilient to future provider renames. Use the
existing secret-reader-rbac policy entry and the Crossplane provider matchers as
the place to update.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f277f803-1bea-490d-8077-8ce94fbd5e2d
📒 Files selected for processing (3)
k8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
devantler-tech/actions(auto-detected)devantler-tech/aws(auto-detected)devantler-tech/reusable-workflows(auto-detected)devantler-tech/ksail(auto-detected)devantler-tech/ascoachingogvaner(auto-detected)devantler-tech/wedding-app(auto-detected)devantler-tech/agent-skills(auto-detected)
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: 🧪 Validate Manifests
- GitHub Check: Analyze (python)
- GitHub Check: Analyze (python)
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{yaml,yml}: Use Kustomize overlays rather than editing base resources directly;k8s/bases/is immutable from overlays and changes should be made withpatches:in provider or cluster overlays.
Keep manifest changes small and use YAML/schema validation before submitting a manifest PR; for files with cluster context, preferksail workload validate/kubectl kustomize/kubectl apply --dry-run=clientas appropriate.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
k8s/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/**: Respect Flux dependency order:bootstrap→infrastructure-controllers→infrastructure→apps, with the prod-onlyinfrastructure-overprovisioninglayer hanging offinfrastructurewithout gatingapps.
Follow the hierarchical Kustomization flow: base configurations ink8s/bases/feed provider overlays ink8s/providers/, which feed cluster overlays ink8s/clusters/.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
k8s/bases/infrastructure/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/bases/infrastructure/**: Underk8s/bases/infrastructure/, organize resources component-folder-first: a component's HelmRelease/HelmRepository and its own CRs should live together in a folder named after the component unless a split is required.
Split a custom resource into its own plural-Kind folder only when it cannot live with its component, such as for CRD dependency ordering or because it is cluster-scoped/cross-cutting.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
k8s/bases/infrastructure/**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
k8s/bases/infrastructure/**/*.{yaml,yml}: For component-folder files, name manifests after the resource Kind in kebab-case; if a folder contains multiple resources of the same Kind, qualify filenames with a purpose suffix.
For CR-folder files, omit the folder-implied Kind from the filename and use theverb-purpose.yamlform.
Name FluxKustomizationresourcesflux-kustomization*.yaml; keep the kustomize build file named exactlykustomization.yaml.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
🧠 Learnings (2)
📚 Learning: 2026-07-01T21:13:36.950Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.
Applied to files:
k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
📚 Learning: 2026-07-04T13:30:04.759Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2446
File: k8s/bases/infrastructure/cluster-security-exceptions/delete-rbac.yaml:38-125
Timestamp: 2026-07-04T13:30:04.759Z
Learning: For Kubescape ClusterSecurityException (apiVersion kubescape.io/v1beta1) and the mirrored Headlamp exception config, do NOT pin `spec.match.resources[].name` (and Headlamp `attributes.name`) to a single literal value when the identifier includes a generated hash. These fields are compared using `regexCompare`, so match such resources with an anchored regular expression that covers the stable prefix and the hash pattern (e.g., `^crossplane:provider:provider-upjet-github-[0-9a-f]+:system$`) rather than the current hash, so the exception remains valid across provider re-installs/revisions.
Applied to files:
k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yamlk8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
🔇 Additional comments (4)
k8s/bases/infrastructure/cluster-security-exceptions/controller-rbac.yaml (2)
23-35: LGTM!
36-49: LGTM!The expanded NOTE accurately documents why RBAC-object controls can't be suppressed via
namespaceSelectorand correctly cross-referencessecret-reader-rbac.yaml, consistent with that manifest's own header comment.k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yaml (1)
6-9: LGTM!
secret-reader-rbac.yamlis correctly registered and keeps the resource list alphabetically ordered.Also applies to: 15-15
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml (1)
73-76: LGTM!Correctly mirrors controller-rbac.yaml's updated posture list (C-0015 replaced by C-0053).
CodeRabbit review-body resolution record ( |
@coderabbitai review |
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml (1)
61-269: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAnchor the literal Kubescape matchers.
spec.match.resources[].nameis regex-based, so unanchored literals likeoperator,longhorn, andflux-operatorcan overmatch future RBAC objects and suppress C-0015 unintentionally. Add^...$around the non-regex names here and leave the intentionally regex-shaped entries unchanged.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml` around lines 61 - 269, The literal RBAC name matchers in the secret-reader rules are being treated as regex patterns, so unanchored entries can overmatch and hide unrelated resources. Update the `spec.match.resources[].name` entries in `secret-reader-rbac.yaml` for the plain literals in this block to use exact anchors, especially the `operator`, `longhorn`, and `flux-operator` style names, while leaving the already regex-shaped `^crossplane:...$` entries unchanged.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml`:
- Around line 61-269: The literal RBAC name matchers in the secret-reader rules
are being treated as regex patterns, so unanchored entries can overmatch and
hide unrelated resources. Update the `spec.match.resources[].name` entries in
`secret-reader-rbac.yaml` for the plain literals in this block to use exact
anchors, especially the `operator`, `longhorn`, and `flux-operator` style names,
while leaving the already regex-shaped `^crossplane:...$` entries unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b5579ae9-f801-40b9-9fb4-763ad793d816
📒 Files selected for processing (2)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yamlk8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
devantler-tech/actions(auto-detected)devantler-tech/aws(auto-detected)devantler-tech/reusable-workflows(auto-detected)devantler-tech/ksail(auto-detected)devantler-tech/ascoachingogvaner(auto-detected)devantler-tech/wedding-app(auto-detected)devantler-tech/agent-skills(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{yaml,yml}: Use Kustomize overlays rather than editing base resources directly;k8s/bases/is immutable from overlays and changes should be made withpatches:in provider or cluster overlays.
Keep manifest changes small and use YAML/schema validation before submitting a manifest PR; for files with cluster context, preferksail workload validate/kubectl kustomize/kubectl apply --dry-run=clientas appropriate.
Files:
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yamlk8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
k8s/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/**: Respect Flux dependency order:bootstrap→infrastructure-controllers→infrastructure→apps, with the prod-onlyinfrastructure-overprovisioninglayer hanging offinfrastructurewithout gatingapps.
Follow the hierarchical Kustomization flow: base configurations ink8s/bases/feed provider overlays ink8s/providers/, which feed cluster overlays ink8s/clusters/.
Files:
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yamlk8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
k8s/bases/infrastructure/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/bases/infrastructure/**: Underk8s/bases/infrastructure/, organize resources component-folder-first: a component's HelmRelease/HelmRepository and its own CRs should live together in a folder named after the component unless a split is required.
Split a custom resource into its own plural-Kind folder only when it cannot live with its component, such as for CRD dependency ordering or because it is cluster-scoped/cross-cutting.
Files:
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yamlk8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
k8s/bases/infrastructure/**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
k8s/bases/infrastructure/**/*.{yaml,yml}: For component-folder files, name manifests after the resource Kind in kebab-case; if a folder contains multiple resources of the same Kind, qualify filenames with a purpose suffix.
For CR-folder files, omit the folder-implied Kind from the filename and use theverb-purpose.yamlform.
Name FluxKustomizationresourcesflux-kustomization*.yaml; keep the kustomize build file named exactlykustomization.yaml.
Files:
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yamlk8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
🧠 Learnings (2)
📚 Learning: 2026-07-01T21:13:36.950Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.
Applied to files:
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yamlk8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
📚 Learning: 2026-07-04T13:30:04.759Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2446
File: k8s/bases/infrastructure/cluster-security-exceptions/delete-rbac.yaml:38-125
Timestamp: 2026-07-04T13:30:04.759Z
Learning: For Kubescape ClusterSecurityException (apiVersion kubescape.io/v1beta1) and the mirrored Headlamp exception config, do NOT pin `spec.match.resources[].name` (and Headlamp `attributes.name`) to a single literal value when the identifier includes a generated hash. These fields are compared using `regexCompare`, so match such resources with an anchored regular expression that covers the stable prefix and the hash pattern (e.g., `^crossplane:provider:provider-upjet-github-[0-9a-f]+:system$`) rather than the current hash, so the exception remains valid across provider re-installs/revisions.
Applied to files:
k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yamlk8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
🔀 Multi-repo context devantler-tech/ksail, devantler-tech/reusable-workflows, devantler-tech/actions, devantler-tech/aws, devantler-tech/ascoachingogvaner, devantler-tech/wedding-app, devantler-tech/agent-skills
Linked repositories findings
devantler-tech/ksail [::devantler-tech/ksail::]
pkg/client/kubescape/client.goandpkg/client/kubescape/buildscaninfo_test.goshow KSail forwards an exceptions file path directly to Kubescape viaUseExceptions/--exceptions, and the contract is specifically a JSON array ofPostureExceptionPolicyobjects.pkg/apis/cluster/v1alpha1/types.go:236-242,schemas/ksail-config.schema.json:1100, andweb/ui/src/generated/ksail-config.ts:844all document the same exceptions-file contract, so the newsecret-reader-rbac.yamlmust stay parseable as Kubescape native exceptions JSON/YAML.pkg/cli/cmd/workload/scan.go:36-139andpkg/cli/cmd/workload/workload_test.go:2792-2985verify--exceptionsprecedence and behavior, but do not special-caseC-0015; this change is consumed as data only.
Other linked repos [::devantler-tech/reusable-workflows::] [::devantler-tech/actions::] [::devantler-tech/aws::] [::devantler-tech/ascoachingogvaner::] [::devantler-tech/wedding-app::] [::devantler-tech/agent-skills::]
- No relevant references found to
C-0015,secret-reader-rbac,controller-rbac,headlamp-exceptions,ClusterSecurityException,SecurityException, orkubescape.
🔇 Additional comments (2)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml (1)
1-58: LGTM!k8s/bases/infrastructure/controllers/kubescape/config-map-headlamp-exceptions.yaml (1)
73-76: LGTM!Also applies to: 519-988
Kubescape matches ClusterSecurityException resource names as unanchored regexes, so a literal like 'operator' or 'longhorn' could silently suppress C-0015 on future RBAC objects whose names merely contain it. Anchoring every literal (the crossplane hash entries were already regex-shaped) also brings the CSE in line with the Headlamp mirror, which was anchored all along. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Resolution record — CodeRabbit review-body finding ( Valid — Kubescape matches |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml (1)
60-269: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider YAML anchors to cut repetition (optional).
Nearly every entry repeats
apiGroup: rbac.authorization.k8s.iopluskind: ClusterRole/kind: Roleacross ~70 list items. YAML anchors/merge keys could shrink this significantly, e.g.:resources: - &clusterRoleMatch apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: ^crd-controller-flux-system$ - <<: *clusterRoleMatch name: ^tf-runner-role$Purely a readability nicety; not required since this mirrors the established pattern in sibling files (e.g.
wildcard-rbac.yaml).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml` around lines 60 - 269, The RBAC allowlist in the secret-reader rules repeats the same apiGroup and kind fields across many entries, so consider refactoring the list with YAML anchors/merge keys in the resources block to reduce duplication while preserving the same ClusterRole and Role name patterns. Use the existing resource entries in this manifest as the source of truth and apply the same pattern consistently to related symbols like the ClusterRole and Role items without changing behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml`:
- Around line 244-253: The generic Role exemptions are too broad because the
name matchers like ^operator$, ^longhorn$, ^vault-config$, and ^velero-server$
are namespace-blind in the cluster-security-exceptions config. Update the
relevant matcher entries in the secret-reader RBAC exception list to scope each
Role by namespace, using the existing Role/ClusterRole patterns in this YAML so
only the intended namespace-specific roles are exempted.
---
Outside diff comments:
In
`@k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml`:
- Around line 60-269: The RBAC allowlist in the secret-reader rules repeats the
same apiGroup and kind fields across many entries, so consider refactoring the
list with YAML anchors/merge keys in the resources block to reduce duplication
while preserving the same ClusterRole and Role name patterns. Use the existing
resource entries in this manifest as the source of truth and apply the same
pattern consistently to related symbols like the ClusterRole and Role items
without changing behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c26dc5e6-0b29-4951-96b7-77e911e1e204
📒 Files selected for processing (1)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
devantler-tech/actions(auto-detected)devantler-tech/aws(auto-detected)devantler-tech/reusable-workflows(auto-detected)devantler-tech/ksail(auto-detected)devantler-tech/ascoachingogvaner(auto-detected)devantler-tech/wedding-app(auto-detected)devantler-tech/agent-skills(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{yaml,yml}: Use Kustomize overlays rather than editing base resources directly;k8s/bases/is immutable from overlays and changes should be made withpatches:in provider or cluster overlays.
Keep manifest changes small and use YAML/schema validation before submitting a manifest PR; for files with cluster context, preferksail workload validate/kubectl kustomize/kubectl apply --dry-run=clientas appropriate.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
k8s/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/**: Respect Flux dependency order:bootstrap→infrastructure-controllers→infrastructure→apps, with the prod-onlyinfrastructure-overprovisioninglayer hanging offinfrastructurewithout gatingapps.
Follow the hierarchical Kustomization flow: base configurations ink8s/bases/feed provider overlays ink8s/providers/, which feed cluster overlays ink8s/clusters/.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
k8s/bases/infrastructure/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/bases/infrastructure/**: Underk8s/bases/infrastructure/, organize resources component-folder-first: a component's HelmRelease/HelmRepository and its own CRs should live together in a folder named after the component unless a split is required.
Split a custom resource into its own plural-Kind folder only when it cannot live with its component, such as for CRD dependency ordering or because it is cluster-scoped/cross-cutting.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
k8s/bases/infrastructure/**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
k8s/bases/infrastructure/**/*.{yaml,yml}: For component-folder files, name manifests after the resource Kind in kebab-case; if a folder contains multiple resources of the same Kind, qualify filenames with a purpose suffix.
For CR-folder files, omit the folder-implied Kind from the filename and use theverb-purpose.yamlform.
Name FluxKustomizationresourcesflux-kustomization*.yaml; keep the kustomize build file named exactlykustomization.yaml.
Files:
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
🧠 Learnings (2)
📚 Learning: 2026-07-01T21:13:36.950Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.
Applied to files:
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
📚 Learning: 2026-07-04T13:30:04.759Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2446
File: k8s/bases/infrastructure/cluster-security-exceptions/delete-rbac.yaml:38-125
Timestamp: 2026-07-04T13:30:04.759Z
Learning: For Kubescape ClusterSecurityException (apiVersion kubescape.io/v1beta1) and the mirrored Headlamp exception config, do NOT pin `spec.match.resources[].name` (and Headlamp `attributes.name`) to a single literal value when the identifier includes a generated hash. These fields are compared using `regexCompare`, so match such resources with an anchored regular expression that covers the stable prefix and the hash pattern (e.g., `^crossplane:provider:provider-upjet-github-[0-9a-f]+:system$`) rather than the current hash, so the exception remains valid across provider re-installs/revisions.
Applied to files:
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
🪛 Trivy (0.69.3)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml
[info] 45-269: limit range usage
A LimitRange policy with a default requests and limits for each container should be configured
Rule: KSV-0039
(IaC/Kubernetes)
🔀 Multi-repo context
Linked repositories findings
devantler-tech/ksail
schemas/ksail-config.schema.json:1098-1116— the workload scanexceptionssetting is documented as a Kubescape-native exceptions file (PostureExceptionPolicyJSON array). This means the newsecret-reader-rbac.yamlmust remain valid Kubescape exceptions data.web/ui/src/generated/ksail-config.ts:840-846— the generated UI config mirrors the same contract and forwards the exceptions file tokubescape --exceptions.pkg/client/kubescape/buildscaninfo_test.goandpkg/client/kubescape/client.go(confirmed by the repo search results) — KSail passes the exceptions path through directly; there’s no special handling forC-0015orClusterSecurityException, so this PR is consumed purely as config/data.
devantler-tech/reusable-workflows, devantler-tech/actions, devantler-tech/aws, devantler-tech/ascoachingogvaner, devantler-tech/wedding-app, devantler-tech/agent-skills
- No references found to
C-0015,secret-reader-rbac,controller-rbac,headlamp-exceptions,ClusterSecurityException,PostureExceptionPolicy, orkubescape.
🔇 Additional comments (1)
k8s/bases/infrastructure/cluster-security-exceptions/secret-reader-rbac.yaml (1)
1-59: LGTM!Also applies to: 60-165
github-project-automation
Bot
moved this from 🫴 Ready
to 🏃🏻♂️ In Progress
in 🌊 Project Board
…5-secret-reader-exception # Conflicts: # k8s/bases/infrastructure/cluster-security-exceptions/kustomization.yaml
Resolution record — CodeRabbit review-body finding ( The finding suggests YAML anchors/merge keys to cut the repeated
No further body findings outstanding; CodeRabbit's final review (22:21Z) is APPROVED. |
github-project-automation
Bot
moved this from 🏃🏻♂️ In Progress
to ✅ Done
in 🌊 Project Board
|
🎉 This PR is included in version 1.101.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Why: The Kubescape control C-0015 ("List Kubernetes secrets") reports 0/50 passing — every service account that can read Secrets shows as failing, so the dashboard gives no usable signal. Its only exception sat under a
namespaceSelector, which Kubescape can't apply to RBAC-based findings (they're keyed on the Role/binding, not a namespace) — so even legitimate readers like cert-manager stayed red. The repo already hit and fixed this for C-0187; C-0015 was left behind.What: Moves C-0015 to a new exception that matches the ~65 legitimate secret-reading controllers/operators/databases by their RBAC object — the proven
wildcard-rbac.yamlpattern — and mirrors it into the Headlamp exceptions ConfigMap. C-0015 becomes a meaningful signal: legitimate readers pass, and a handful of genuinely over-privileged / admin identities remain surfaced on purpose (unused tenanteditSAs, crossview's wildcard read, the cluster-admin/crossplane admin groups).This is a scanner-suppression change only — it grants and removes no privileges. Residual flagged findings tracked in #2441.
Merge order: the posture scan is currently frozen (separate v4.0.9 regression, fixed by #2443) — this change only becomes visible on the dashboard once #2443 lands and scanning resumes. It is correct and safe to merge independently.
Note: agent-authored — needs a direct
gh pr merge --squashafter promotion (not auto-merge).