turbot/kubernetes

GitHub
steampipe plugin install kubernetessteampipe plugin install kubernetes

Table: kubernetes_cluster_role

ClusterRole contains rules that represent a set of permissions. You can use them to grant access to:

  • cluster-scoped resources (like nodes)
  • non-resource endpoints (like /healthz)
  • namespaced resources (like Pods), across all namespaces

Examples

Basic Info

select
name,
creation_timestamp,
rules,
aggregation_rule
from
kubernetes_cluster_role
order by
name;

List rules and verbs for cluster roles

select
name as role_name,
rule ->> 'apiGroups' as api_groups,
rule ->> 'resources' as resources,
rule ->> 'nonResourceURLs' as non_resource_urls,
rule ->> 'verbs' as verbs,
rule ->> 'resourceNames' as resource_names
from
kubernetes_cluster_role,
jsonb_array_elements(rules) as rule
order by
role_name,
api_groups;

Group cluster roles by same set of aggregation rules

select
jsonb_agg(name) as roles,
aggregation_rule
from
kubernetes_cluster_role
group by
aggregation_rule;

List manifest resources

select
name,
rules,
aggregation_rule,
path
from
kubernetes_cluster_role
where
path is not null
order by
name;

Query examples

.inspect kubernetes_cluster_role

ClusterRole contains rules that represent a set of permissions.

NameTypeDescription
_ctxjsonbSteampipe context in JSON form, e.g. connection_name.
aggregation_rulejsonbAn optional field that describes how to build the Rules for this ClusterRole
annotationsjsonbAnnotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata.
context_nametextKubectl config context name.
creation_timestamptimestamp with time zoneCreationTimestamp is a timestamp representing the server time when this object was created.
deletion_grace_period_secondsbigintNumber of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set.
deletion_timestamptimestamp with time zoneDeletionTimestamp is RFC 3339 date and time at which this resource will be deleted.
end_linebigintThe path to the manifest file.
finalizersjsonbMust be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.
generate_nametextGenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided.
generationbigintA sequence number representing a specific generation of the desired state.
labelsjsonbMap of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services.
nametextName of the object. Name must be unique within a namespace.
owner_referencesjsonbList of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
pathtextThe path to the manifest file.
resource_versiontextAn opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed.
rulesjsonbList of the PolicyRules for this Role.
source_typetextThe source of the resource. Possible values are: deployed and manifest. If the resource is fetched from the spec file the value will be manifest.
start_linebigintThe path to the manifest file.
tagsjsonbA map of tags for the resource. This includes both labels and annotations.
titletextTitle of the resource.
uidtextUID is the unique in time and space value for this object.