Hi,

I am getting the following error while running the script.

• Add summary from the perspective of subjects to have better visibility where risky roles are being used.

  Example output:
  

• Dump report as JSON files to be able to consume it some automation

Hello,
I managed to run the python script successfully but am wondering why the cluster-admin was not flagged as one of the risky cluster role? Please advise.

Is your feature request related to a problem? Please describe.

The tool works well, but, it has the potential for false positives when looking for excessive permissions. Take the following example that was flagged as having cluster admin privileges:

            "rules": [
                {
                    "apiGroups": [
                        "dex.coreos.com"
                    ],
                    "resources": [
                        "*"
                    ],
                    "verbs": [
                        "*"
                    ]
                }
            ]

The tool lists this has cluster admin privileges even though in reality the privileges granted are restricted to the dex.coreos.com apiGroup. That isn't to say that having * * on the dex API isn't a bad thing, just that it isn't the same as having cluster admin perms.

Describe the solution you would like

The tool should probably look for apiGroups and list them if found alongside the rest of the details.

Describe alternatives you have considered

In general I think it would be useful for it to be able to output the raw data for each finding so that these are easily validated.

Additional context

Thank you!

Hi, I found a bug in the script. When analyzing the incoming JSON, entity['rules'] may be empty, which causes the program to crash and exit.
I found a solution to fix the issue. Please refer to the image below.