The RBAC component already notes that RoleBinding and ClusterRoleBinding subjects need to stay in sync with the controller ServiceAccount when its name changes. I tried turning that existing rule into a small static regression check.
On current main (2f3ad9bc555c9db5198a0794f1b19dc5b0ec6214), a 35-line IaC-Guard-V 0.1.0a10 contract finds the three bindings in config/rbac. All nine subject, roleRef, and scope checks return SATISFIED.
I also tried four local changes:
- removed the leader-election Role
- removed the controller ServiceAccount
- changed the leader-election RoleBinding to use an invalid
roleRef kind
- applied a consistent Kustomize name prefix to every resource
The first three return VIOLATED. The consistent rename remains SATISFIED, so the check is tied to the relationships rather than the current resource names.
The existing tests cover resource generation and runtime behavior, but I could not find a check that resolves every binding to its ServiceAccount and Role or ClusterRole across the complete rendered RBAC component.
The proposed check only reads kubectl kustomize config/rbac output. It does not connect to a cluster or use credentials. Rendering, linting, planning, and verification took about 2.2 seconds locally after installation.
Would maintainers be interested in a small PR that adds the suggested contract and a read-only verify-iac-contract make target? I can leave the target optional at first or add it to the existing GitHub Actions checks, depending on what the project prefers.
IaC-Guard-V 0.1.0a10: https://github.com/lokesh0186/iac-guard-v/releases/tag/v0.1.0-alpha.10
The RBAC component already notes that RoleBinding and ClusterRoleBinding subjects need to stay in sync with the controller ServiceAccount when its name changes. I tried turning that existing rule into a small static regression check.
On current main (
2f3ad9bc555c9db5198a0794f1b19dc5b0ec6214), a 35-line IaC-Guard-V 0.1.0a10 contract finds the three bindings inconfig/rbac. All nine subject,roleRef, and scope checks returnSATISFIED.I also tried four local changes:
roleRefkindThe first three return
VIOLATED. The consistent rename remainsSATISFIED, so the check is tied to the relationships rather than the current resource names.The existing tests cover resource generation and runtime behavior, but I could not find a check that resolves every binding to its ServiceAccount and Role or ClusterRole across the complete rendered RBAC component.
The proposed check only reads
kubectl kustomize config/rbacoutput. It does not connect to a cluster or use credentials. Rendering, linting, planning, and verification took about 2.2 seconds locally after installation.Would maintainers be interested in a small PR that adds the suggested contract and a read-only
verify-iac-contractmake target? I can leave the target optional at first or add it to the existing GitHub Actions checks, depending on what the project prefers.IaC-Guard-V 0.1.0a10: https://github.com/lokesh0186/iac-guard-v/releases/tag/v0.1.0-alpha.10