Lineage
Who has access to what in OpenShift, and why
- Role
- Sole developer: I did the design, implementation, testing and documentation
- Status
- Open source · early v1
- Stack
- Python · Flask · OpenShift · RBAC · SCC · Helm · pytest
00 · Summary
A read-only tool that turns OpenShift access objects into explainable paths across identities, groups, RBAC, Security Context Constraints, service accounts, workloads and images.
01 · The problem
To answer “why can this user read secrets in payments-prod?” someone has to stitch together Users, Identities, Groups, RoleBindings, ClusterRoles, SCCs and workloads by hand. A binding to a deleted subject looks harmless until someone recreates the name and the access comes back.
02 · The idea
Model access as a graph and show the whole chain: alice → platform-team → RoleBinding/secret-readers → Role/read-secrets → get/list secrets in payments-prod. Treat “clean” and “could not see enough to say” as different results.
03 · How it works
- 01
Collect
Read-only API access to identities, RBAC, SCCs, namespaces, workloads and images.
- 02
Connect
Build the access graph, including stale references to deleted subjects.
- 03
Explain
Paths, findings, global search and anomalies in the browser.
- 04
Gate
CLI and JSON audits with configurable exit codes for pipelines.
04 · The hard part
Never mistaking blindness for safety
A scan running with missing permissions must not look like a clean result. Lineage tracks degraded visibility explicitly, so incomplete data is reported as incomplete rather than as safe.
05 · What I built
- Python and Flask application with browser views, global search and findings
- CLI and JSON audit output with configurable exit codes
- Helm chart and OpenShift build manifests for in-cluster installs
- Mock-data mode and a public static demo
06 · Results
- 480 tests in the documented release suite, covering access relationships, routes, CLI output and edge cases.
- 4.19 · 4.21 OpenShift versions tested on OpenShift Local (CRC), a single-node local cluster.
07 · Why it matters
Access reviews on Kubernetes platforms are slow and error-prone. Lineage combines platform knowledge with tooling that turns a question someone asks during an audit into a report a pipeline can enforce.