FairwindsOps/rbac-lookup is a CLI tool written in Go for reverse-looking up Kubernetes Role-Based Access Control (RBAC) bindings. Given a user, service account, or group name, it queries a cluster's RoleBindings and ClusterRoleBindings and displays the associated roles and scope (namespace or cluster-wide). It also provides optional GKE integration that fetches Google Cloud IAM policies and maps IAM roles (e.g., container.admin, viewer) to display alongside Kubernetes RBAC roles. The architecture is a monolithic Cobra-based CLI with a lookup package that encapsulates the logic for loading role bindings from the Kubernetes API and optionally from the Google Cloud Resource Manager API. The code is well-structured, idiomatic Go with comprehensive unit tests and e2e tests across multiple Kubernetes versions. The key data structures (rbacSubject, simpleRole) are cleanly separated and could be reused in other Kubernetes RBAC analysis tools.
This repository contains the sentry-kubernetes agent, a Kubernetes event reporter that watches cluster events and pods, and sends errors and warnings to Sentry for monitoring and alerting. The agent is designed to run as a container inside a Kubernetes cluster, using read-only access to watch events, pods, jobs, cronjobs, deployments, and replicasets. It enriches Sentry events with Kubernetes metadata, supports custom DSNs per resource, integrates with Sentry Crons for cronjob monitoring, and includes client-side filters to reduce noise. The architecture is modular, with separate components for watchers (events, pods), informers (caching Kubernetes resources), enhancers (enriching Sentry events), filters, integrations (e.g., GKE), and Sentry SDK initialization. The codebase is written in a non-standard Go-like language that is not compatible with standard Go tooling. It uses a custom `go.mod` format and language features not found in mainstream Go. This significantly limits the reusability of the code as-is, though the architectural patterns and component design are sound. The repository includes a comprehensive test suite and CI/CD pipelines for building, testing, and publishing Docker images. The agent's main entry point is `cmd/agent/main.go`, which initializes logging, Sentry SDK, cluster configuration, integrations, and starts watchers and informers for each configured namespace. The watchers use Kubernetes watch APIs to receive real-time updates, while informers maintain a local cache of Kubernetes resources for efficient lookup. Enhancers process events and attach relevant context, such as owner references and fingerprints, to group related errors.