UD-1664: Add check for unauthenticated or anonymous subjects within r…

[knrc]

…ole bindings

Description

This PR adds a new builtin check. It identifies cluster role bindings and role bindings which reference the unauthenticated group or anonymous user.

Linked Issues

How has this been tested?

• Updated builtin tests
• Built new marvin, deployed to cluster and checked reports on saas

Checklist

• I have labeled this PR with the relevant Type labels
• I have documented my code (if applicable)
• My changes are covered by tests

[knrc]

Note: This check is currently a Medium severity, however it may be better to specify it as a High severity given the potential for abuse

[matheusfm]

It seems like every cluster has a default ClusterRoleBinding called system:public-info-viewer which would be reported as a misconfiguration. CEL Playground experiment.

Do you think having an exception for this cases makes sense?

The kubernetes.io/bootstrapping: rbac-defaults label may help with an exception rule.

[knrc]

It seems like every cluster has a default ClusterRoleBinding called system:public-info-viewer which would be reported as a misconfiguration. CEL Playground experiment.

Do you think having an exception for this cases makes sense?

The kubernetes.io/bootstrapping: rbac-defaults label may help with an exception rule.

While the role is provided by default it doesn't need to exist, and probably shouldn't if the cluster is being hardened. Given this, I think it is better to report the existence and let the users decide whether they want to deal with it (i.e. remove the binding) or ignore it.