Unused RoleBinding

RoleBinding grants Role permissions to ServiceAccounts or Users. This validator detects RoleBindings that are not associated with any application workloads.

Affected Resources: RoleBinding, ClusterRoleBinding

Example

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: backend
...

Resolution

Examine applications within the namespace and determine if ServiceAccount in RoleBinding is supposed to be used in those workloads.

Make necessary naming corrections in RoleBinding ServiceAccount subject references.

If the RoleBinding is indeed unused, it may need to be just removed.

Learn More

https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-subjects

Unused Role

Unused ServiceAccount

Need other validation rules?

Please let us know if there are other built-in validation rules you would like to see in Kubevious to detect misconfigurations and violations to best practices. Optionally, you can provide your details so we can reach out to you with follow-up questions.

Share this article on: