Now checks for privileged system users instead of groups + Unit tests

.github/workflows/unit-test.yml

@@ -0,0 +1,35 @@
+name: Go unit tests
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24.x'
+      - name: Check gofmt compliant
+        run: |
+          cd src
+          if [[ $(gofmt -l .) ]]; then
+              echo "Files not gofmt compliant:"
+              gofmt -l .
+              exit 1
+          else
+              exit 0
+          fi
+      - name: Install dependencies
+        run: |
+          cd src
+          go get .
+      - name: Test with Go
+        run: |
+          cd src
+          go test -v

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24
+FROM golang:1.24 AS build-stage
 
 WORKDIR /app
 
@@ -9,6 +9,12 @@ COPY src/*.go ./
 
 RUN CGO_ENABLED=0 GOOS=linux go build -o /azimuth-authorization-webhook
 
+FROM gcr.io/distroless/base-debian11 AS build-release-stage
+
+WORKDIR /
+
+COPY --from=build-stage /azimuth-authorization-webhook /azimuth-authorization-webhook
+
 EXPOSE 8080
 
 ENTRYPOINT ["/azimuth-authorization-webhook"]

README.md

@@ -0,0 +1,19 @@
+# Azimuth Authorization Webhook
+
+A Kubernetes authorization webhook to protect sensitive namespaces when users require
+read-write access to all other cluster resources (e.g when they wish to install arbitrary CRDS).
+
+Policy:
+- Users cannot read secrets in protected namespaces by default
+- Users cannot write any other resource in protected namespaces by default
+- Internal K8s `system:` users may read/write to protected namespaces, excluding service accounts and `system:anonymous`
+- Service accounts in protected namespaces may read/write to all protected namespaces
+- Users specified as privileged may read/write to protected namespaces
+
+## Flags
+| Flag | Arguments |
+| --- | --- |
+| `--allow-opinion-mode` | Specifies if the webhook should give its opinion on requests which it doesn't deny. If true, will set 'allowed' to `true` in SubjectAccessReview response. Default: `false` |
+| `--additional-privileged-users` | Comma separate listed of users to be given read/write access to protected namespaces. Default: `""` |
+| `--log-level` | Verbosity of logs <br>`0`: Internal errors only. <br>`1`: Logs high level requests info. <br>`2`: Logs HTTP dumps of requests. <br>Default: `1` |
+| `--protected-namespaces` | Comma separated list of protected namespaces. Default: `kube-system,openstack-system` |

chart/templates/deployment.yaml

@@ -23,7 +23,7 @@ spec:
               containerPort: 8080
               protocol: TCP
           args:
+          - --additional-privileged-users={{ join "," .Values.additionalPrivilegedUsers }}
           - --log-level={{ .Values.logLevel }}
           - --protected-namespaces={{ join "," .Values.protectedNamespaces }}
-          - --unpriveleged-group={{ .Values.unprivilegedGroup }}
           - --allow-opinion-mode={{ .Values.allowOpinionMode }}

chart/values.yaml

@@ -1,11 +1,11 @@
 port: 8080
-version: 2f72ea1
+version: 706400d
 
 logLevel: 1
 protectedNamespaces:
   - kube-system
   - openstack-system
-unprivilegedGroup: "oidc:/platform-users"
+additionalPrivilegedUsers: []
 allowOpinionMode: false
 
 ingress: