Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package polaris for openSUSE:Factory checked in at 2026-09-19 22:21:20 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/polaris (Old) and /work/SRC/openSUSE:Factory/.polaris.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "polaris" Sat Sep 19 22:21:20 2026 rev:53 rq:1378933 version:10.2.5 Changes: -------- --- /work/SRC/openSUSE:Factory/polaris/polaris.changes 2026-09-18 22:08:06.876556619 +0200 +++ /work/SRC/openSUSE:Factory/.polaris.new.383539/polaris.changes 2026-09-19 22:22:30.028002738 +0200 @@ -1,0 +2,7 @@ +Sat Sep 19 06:16:31 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 10.2.5: + * INS-2916: rolebindingRolePodExecAttach treats an ommited role + namespace as globally matchable (#1244) + +------------------------------------------------------------------- Old: ---- polaris-10.2.4.obscpio New: ---- polaris-10.2.5.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ polaris.spec ++++++ --- /var/tmp/diff_new_pack.mA2SOB/_old 2026-09-19 22:22:31.250053705 +0200 +++ /var/tmp/diff_new_pack.mA2SOB/_new 2026-09-19 22:22:31.252053789 +0200 @@ -17,7 +17,7 @@ Name: polaris -Version: 10.2.4 +Version: 10.2.5 Release: 0 Summary: Validation of best practices in your Kubernetes clusters License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.mA2SOB/_old 2026-09-19 22:22:31.284055124 +0200 +++ /var/tmp/diff_new_pack.mA2SOB/_new 2026-09-19 22:22:31.287055249 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/FairwindsOps/polaris.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v10.2.4</param> + <param name="revision">refs/tags/v10.2.5</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.mA2SOB/_old 2026-09-19 22:22:31.309056166 +0200 +++ /var/tmp/diff_new_pack.mA2SOB/_new 2026-09-19 22:22:31.311056250 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/FairwindsOps/polaris</param> <param name="changesrevision">1fdfec73a1a6611078cad745340ad2f0ae0f7db7</param></service><service name="tar_scm"> <param name="url">https://github.com/FairwindsOps/polaris.git</param> - <param name="changesrevision">1b4534a6256f148843a60a08c374a35a257047f8</param></service></servicedata> + <param name="changesrevision">c84bb2ea3674ee7ec044584db8c9cc9e8d17bdd0</param></service></servicedata> (No newline at EOF) ++++++ polaris-10.2.4.obscpio -> polaris-10.2.5.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/polaris-10.2.4/pkg/validator/schema.go new/polaris-10.2.5/pkg/validator/schema.go --- old/polaris-10.2.4/pkg/validator/schema.go 2026-09-16 17:03:54.000000000 +0200 +++ new/polaris-10.2.5/pkg/validator/schema.go 2026-09-18 16:20:52.000000000 +0200 @@ -413,9 +413,12 @@ namespace := test.Resource.ObjectMeta.GetNamespace() if test.Resource.Kind == "Namespace" { namespace = test.Resource.ObjectMeta.GetName() + } else { + namespace = effectiveNamespace(test.Resource.Kind, namespace) } resources = funk.Filter(resources, func(res kube.GenericResource) bool { - return res.ObjectMeta.GetNamespace() == "" || res.ObjectMeta.GetNamespace() == namespace + resNS := effectiveNamespace(res.Kind, res.ObjectMeta.GetNamespace()) + return resNS == "" || resNS == namespace }).([]kube.GenericResource) objects := funk.Map(resources, func(res kube.GenericResource) any { return res.Resource.Object @@ -447,6 +450,22 @@ return &result, nil } +// effectiveNamespace is the namespace Kubernetes would use for this object. +// ClusterRole and ClusterRoleBinding are the cluster-scoped kinds this matcher +// looks up or checks; they keep an empty namespace and stay visible everywhere. +// An omitted namespace on any other kind is default, not cluster-wide. +func effectiveNamespace(kind, namespace string) string { + if namespace != "" { + return namespace + } + switch kind { + case "ClusterRole", "ClusterRoleBinding": + return "" + default: + return metaV1.NamespaceDefault + } +} + func getSortedKeys(m map[string]config.Severity) []string { keys := make([]string, 0, len(m)) for key := range m { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/polaris-10.2.4/test/checks/rolebindingRolePodExecAttach/failure.role_omits_namespace.yaml new/polaris-10.2.5/test/checks/rolebindingRolePodExecAttach/failure.role_omits_namespace.yaml --- old/polaris-10.2.4/test/checks/rolebindingRolePodExecAttach/failure.role_omits_namespace.yaml 1970-01-01 01:00:00.000000000 +0100 +++ new/polaris-10.2.5/test/checks/rolebindingRolePodExecAttach/failure.role_omits_namespace.yaml 2026-09-18 16:20:52.000000000 +0200 @@ -0,0 +1,26 @@ +# This fails because the Role omits metadata.namespace. Kubernetes treats an empty +# namespace as default, so the Role is not a valid target for a RoleBinding in team-a. +# The Role does not allow pods/exec|attach; a pass here would mean the empty-namespace +# Role was treated as globally eligible during additional-object matching. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: test +rules: + - apiGroups: [ "" ] + resources: [ "pods" ] + verbs: [ get, create ] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: test + namespace: team-a +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: test +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: User + name: testuser ++++++ polaris.obsinfo ++++++ --- /var/tmp/diff_new_pack.mA2SOB/_old 2026-09-19 22:22:31.569067010 +0200 +++ /var/tmp/diff_new_pack.mA2SOB/_new 2026-09-19 22:22:31.572067135 +0200 @@ -1,5 +1,5 @@ name: polaris -version: 10.2.4 -mtime: 1789571034 -commit: 1b4534a6256f148843a60a08c374a35a257047f8 +version: 10.2.5 +mtime: 1789741252 +commit: c84bb2ea3674ee7ec044584db8c9cc9e8d17bdd0 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/polaris/vendor.tar.gz /work/SRC/openSUSE:Factory/.polaris.new.383539/vendor.tar.gz differ: char 141, line 1
