[Audit] Require explicit namespaces for K8s discovery RBAC

[RaminNietzsche]

Background

Kubernetes discovery RBAC defaults are too broad for shared clusters.

Problem

Empty K8S_DISCOVERY_NAMESPACES / Helm namespaces: "" leads to listDeploymentForAllNamespaces with a ClusterRole listing Deployments cluster-wide (server/services/discovery/kubernetes.ts, charts/cve-radar/templates/rbac-discovery.yaml).

Proposed solution

• Require explicit namespace list when discovery is enabled
• Prefer namespaced Role/RoleBinding over ClusterRole
• Helm fail when enabled && namespaces empty unless allowAllNamespaces: true

Acceptance criteria

• Default install cannot list all namespaces
• Docs/values make scope explicit
• Tests cover empty-namespace rejection

Priority

P1 / Medium

Complexity

Small

Evidence

server/services/discovery/kubernetes.ts, server/lib/k8sDiscoveryConfig.ts, Helm rbac-discovery

[github-actions]

The issue highlights concerns about overly broad Kubernetes discovery RBAC defaults in shared clusters, where empty namespace configurations can result in unintended cluster-wide access. The proposed solution includes requiring explicit namespace lists, using namespaced Role/RoleBindings instead of ClusterRoles, and making Helm configurations fail if namespaces are empty unless explicitly allowed. Acceptance criteria involve preventing default installations from listing all namespaces, ensuring clear documentation, and validating configurations through testing. Priority is set to medium with low complexity.