Listing secret not capturing as a risky rule #10
Description
My RBAC (ServiceAccount,Role & RoleBinding) as follows, which has a role of listing secrets.
apiVersion: v1
kind: ServiceAccount
metadata:
name: listsecrets
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: role-list-secrets
rules:
- apiGroups: ["*"]
resources: ["secrets"]
verbs: ["list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: rolebinding-list-secrets
subjects:
- kind: ServiceAccount
name: listsecrets
namespace: testing
roleRef:
kind: Role
name: role-list-secrets
apiGroup: rbac.authorization.k8s.io
But kubiscan -rr does not capturing/show as a risky rule.
Not sure what is the criteria of risky rule?