Bastion/docs/samples/diff-transcript.txt at main · mk12002/Bastion · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
$ bastion diff ./base-branch ./pull-request --fail-on-new-path

Bastion diff  tests/fixtures/diff/before -> tests/fixtures/diff/after
Posture score: 89 -> 56 (-33)

This change introduces 3 new escalation path(s). The shortest: ServiceAccount core/controller-sa can reach cluster-admin in 1 step(s).

Introduced paths (3)

ServiceAccount core/controller-sa -> cluster-admin  [1 step(s), medium confidence]
  1. CAN_BIND -> cluster-admin
     evidence: chain.yaml:144

ServiceAccount app/debugger -> cluster-admin  [3 step(s), medium confidence]
  1. CAN_EXEC -> Deployment core/controller
     evidence: chain.yaml:84
  2. RUNS_AS -> ServiceAccount core/controller-sa
     evidence: chain.yaml:115
  3. CAN_BIND -> cluster-admin
     evidence: chain.yaml:144

ServiceAccount app/ci-runner -> cluster-admin  [4 step(s), medium confidence]
  1. CAN_CREATE -> ServiceAccount app/debugger
     evidence: chain.yaml:57
  2. CAN_EXEC -> Deployment core/controller
     evidence: chain.yaml:84
  3. RUNS_AS -> ServiceAccount core/controller-sa
     evidence: chain.yaml:115
  4. CAN_BIND -> cluster-admin
     evidence: chain.yaml:144

Gate failed: 3 new escalation path(s) to a critical terminal.
$ echo $?
1