diff --git a/internal/graph/kubernetes.go b/internal/graph/kubernetes.go index 56ef439..f52f9d3 100644 --- a/internal/graph/kubernetes.go +++ b/internal/graph/kubernetes.go @@ -62,6 +62,7 @@ const ( RelationshipPodNode Relationship = "PodNode" RelationshipPodPriorityClass Relationship = "PodPriorityClass" RelationshipPodRuntimeClass Relationship = "PodRuntimeClass" + RelationshipPodSecurityPolicy Relationship = "PodSecurityPolicy" RelationshipPodVolume Relationship = "PodVolume" RelationshipPodVolumeCSIDriver Relationship = "PodVolumeCSIDriver" RelationshipPodVolumeCSIDriverSecret Relationship = "PodVolumeCSIDriverSecret" //nolint:gosec @@ -518,6 +519,15 @@ func getPodRelationships(n *Node) (*RelationshipMap, error) { result.AddDependencyByKey(ref.Key(), RelationshipPodRuntimeClass) } + // RelationshipPodSecurityPolicy + // Hardcode "k8s.io/kubernetes/pkg/security/podsecuritypolicy/util.ValidatedPSPAnnotation" + // as "kubernetes.io/psp" so we don't need import the entire k8s.io/kubernetes + // package + if psp, ok := pod.Annotations["kubernetes.io/psp"]; ok { + ref = ObjectReference{Group: "policy", Kind: "PodSecurityPolicy", Name: psp} + result.AddDependencyByKey(ref.Key(), RelationshipPodSecurityPolicy) + } + // RelationshipPodVolume // RelationshipPodVolumeCSIDriver // RelationshipPodVolumeCSIDriverSecret