diff --git a/rules/k8s_audit_rules.yaml b/rules/k8s_audit_rules.yaml index 739e54ff..0052a8a8 100644 --- a/rules/k8s_audit_rules.yaml +++ b/rules/k8s_audit_rules.yaml @@ -366,7 +366,7 @@ tags: [k8s] # Detect any attempt to create a ClusterRoleBinding to the cluster-admin user -# (exapand this to any built-in cluster role that does "sensitive" things) +# (expand this to any built-in cluster role that does "sensitive" things) - rule: Attach to cluster-admin Role desc: Detect any attempt to create a ClusterRoleBinding to the cluster-admin user condition: kevt and clusterrolebinding and kcreate and ka.req.binding.role=cluster-admin diff --git a/test/rules/k8s_audit/engine_v4_k8s_audit_rules.yaml b/test/rules/k8s_audit/engine_v4_k8s_audit_rules.yaml index b9377172..f95d485a 100644 --- a/test/rules/k8s_audit/engine_v4_k8s_audit_rules.yaml +++ b/test/rules/k8s_audit/engine_v4_k8s_audit_rules.yaml @@ -246,7 +246,7 @@ tags: [k8s] # Detect any attempt to create a ClusterRoleBinding to the cluster-admin user -# (exapand this to any built-in cluster role that does "sensitive" things) +# (expand this to any built-in cluster role that does "sensitive" things) - rule: Attach to cluster-admin Role desc: Detect any attempt to create a ClusterRoleBinding to the cluster-admin user condition: kevt and clusterrolebinding and kcreate and ka.req.binding.role=cluster-admin