fix: resolve ClusterRole refs from RoleBindings

[lokesh0186]

Summary

This updates the access-to-resources template to follow roleRef.kind when a RoleBinding references a role.

Kubernetes permits a RoleBinding to reference either a Role in the same namespace or a cluster-scoped ClusterRole. The template currently sends every RoleBinding through namespaced Role lookup, so the built-in access-to-secrets and access-to-create-pods checks can miss permissions granted through RoleBinding -> ClusterRole.

The change routes a ClusterRole reference through the existing cluster-role lookup and adds a focused regression test. Existing RoleBinding -> Role and ClusterRoleBinding -> ClusterRole behavior is unchanged.

Reproduction

I reproduced the gap with kube-linter v0.8.3 and current main at ea3abb8abfe0fc4d7c2b20c9a30d95db9f0b2e2a:

• RoleBinding -> ClusterRole granting get on Secrets: no report, exit 0
• equivalent RoleBinding -> Role: access-to-secrets report, exit 1
• equivalent ClusterRoleBinding -> ClusterRole: access-to-secrets report, exit 1

The same routing gap also reproduces with access-to-create-pods when a RoleBinding references a ClusterRole granting create on Pods.

As an independent role-reference cross-check, public IaC-Guard-V 0.1.0b1 resolves the fixture's RoleBinding to the cluster-scoped ClusterRole and reports the binding scope as consistent. IaC-Guard-V does not simulate authorization and is not used here as the access-to-secrets oracle.

Validation

• go test ./pkg/templates/accesstoresources -count=1
• make test

Both pass with the change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: f4bdc566-281c-4fbf-88dd-235ba2919352

📥 Commits

Reviewing files that changed from the base of the PR and between ea3abb8 and 89df25b.

📒 Files selected for processing (2)

• pkg/templates/accesstoresources/template.go
• pkg/templates/accesstoresources/template_test.go

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes

  • RoleBindings referencing ClusterRoles are now correctly evaluated for access to secrets.
  • Access diagnostics now reflect permissions granted through the referenced ClusterRole.

• Tests

  • Added coverage for RoleBindings connected to ClusterRoles with secret access permissions.

Walkthrough

The access-to-resources template now resolves ClusterRoles referenced by RoleBindings. A test verifies detection of secret access through this binding type.

Changes

RoleBinding ClusterRole resolution

Layer / File(s)	Summary
Resolve and validate referenced ClusterRoles pkg/templates/accesstoresources/template.go, pkg/templates/accesstoresources/template_test.go	RoleBindings use findClusterRole for ClusterRole references. The test verifies a diagnostic for secret access granted by the referenced ClusterRole.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 89df2

RoleBindings that reference ClusterRoles now resolve those permissions correctly, with regression coverage for secret access detection. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: resolving ClusterRole references from RoleBinding objects.
Description check	✅ Passed	The description directly explains the RoleBinding to ClusterRole resolution change, its impact, regression coverage, and validation results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 31.35%. Comparing base (dbd7529) to head (89df25b).
⚠️ Report is 351 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1255       +/-   ##
===========================================
- Coverage   62.36%   31.35%   -31.01%     
===========================================
  Files         197      239       +42     
  Lines        4854     6563     +1709     
===========================================
- Hits         3027     2058      -969     
- Misses       1439     4328     +2889     
+ Partials      388      177      -211     

Flag	Coverage Δ
unit	31.35% <100.00%> (-31.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.