From b0d5adbc1b9d9af74d658e1e9e32c62bd1725cc3 Mon Sep 17 00:00:00 2001
From: doxsch <28098153+doxsch@users.noreply.github.com>
Date: Thu, 8 Jan 2026 12:36:56 +0100
Subject: [PATCH] Add resource-specific health checks for Kubernetes rbac
 resources

Signed-off-by: doxsch <28098153+doxsch@users.noreply.github.com>
---
 README.md                          |  8 ++++----
 healthchecks/clusterrole.go        | 14 ++++++++++++++
 healthchecks/clusterrolebinding.go | 14 ++++++++++++++
 healthchecks/registry.go           |  4 ++++
 healthchecks/role.go               | 14 ++++++++++++++
 healthchecks/rolebinding.go        | 14 ++++++++++++++
 6 files changed, 64 insertions(+), 4 deletions(-)
 create mode 100644 healthchecks/clusterrole.go
 create mode 100644 healthchecks/clusterrolebinding.go
 create mode 100644 healthchecks/role.go
 create mode 100644 healthchecks/rolebinding.go

diff --git a/README.md b/README.md
index 9a006b6..8f1fa1e 100644
--- a/README.md
+++ b/README.md
@@ -51,10 +51,10 @@ This function implements resource-specific health checks for standard Kubernetes
 - [ ] NetworkPolicy
 
 ### RBAC (rbac.authorization.k8s.io/v1)
-- [ ] Role
-- [ ] ClusterRole
-- [ ] RoleBinding
-- [ ] ClusterRoleBinding
+- [x] Role - Always ready if it exists
+- [x] ClusterRole - Always ready if it exists
+- [x] RoleBinding - Always ready if it exists
+- [x] ClusterRoleBinding - Always ready if it exists
 
 ### Storage (storage.k8s.io/v1)
 - [ ] StorageClass
diff --git a/healthchecks/clusterrole.go b/healthchecks/clusterrole.go
new file mode 100644
index 0000000..146f2fa
--- /dev/null
+++ b/healthchecks/clusterrole.go
@@ -0,0 +1,14 @@
+package healthchecks
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func registerClusterRoleHealthCheck() {
+	gvk := schema.GroupVersionKind{
+		Group:   "rbac.authorization.k8s.io",
+		Version: "v1",
+		Kind:    "ClusterRole",
+	}
+	RegisterHealthCheck(gvk, alwaysReady)
+}
diff --git a/healthchecks/clusterrolebinding.go b/healthchecks/clusterrolebinding.go
new file mode 100644
index 0000000..a81cb13
--- /dev/null
+++ b/healthchecks/clusterrolebinding.go
@@ -0,0 +1,14 @@
+package healthchecks
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func registerClusterRoleBindingHealthCheck() {
+	gvk := schema.GroupVersionKind{
+		Group:   "rbac.authorization.k8s.io",
+		Version: "v1",
+		Kind:    "ClusterRoleBinding",
+	}
+	RegisterHealthCheck(gvk, alwaysReady)
+}
diff --git a/healthchecks/registry.go b/healthchecks/registry.go
index a323dca..87ae8cd 100644
--- a/healthchecks/registry.go
+++ b/healthchecks/registry.go
@@ -57,6 +57,8 @@ func getInt64Field(obj map[string]interface{}, path ...string) (int64, bool) {
 
 func init() {
 	// Register all standard Kubernetes resource health checks
+	registerClusterRoleBindingHealthCheck()
+	registerClusterRoleHealthCheck()
 	registerConfigMapHealthCheck()
 	registerCronJobHealthCheck()
 	registerDaemonSetHealthCheck()
@@ -68,6 +70,8 @@ func init() {
 	registerPersistentVolumeClaimHealthCheck()
 	registerPodHealthCheck()
 	registerReplicaSetHealthCheck()
+	registerRoleBindingHealthCheck()
+	registerRoleHealthCheck()
 	registerSecretHealthCheck()
 	registerServiceHealthCheck()
 	registerServiceAccountHealthCheck()
diff --git a/healthchecks/role.go b/healthchecks/role.go
new file mode 100644
index 0000000..bf04965
--- /dev/null
+++ b/healthchecks/role.go
@@ -0,0 +1,14 @@
+package healthchecks
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func registerRoleHealthCheck() {
+	gvk := schema.GroupVersionKind{
+		Group:   "rbac.authorization.k8s.io",
+		Version: "v1",
+		Kind:    "Role",
+	}
+	RegisterHealthCheck(gvk, alwaysReady)
+}
diff --git a/healthchecks/rolebinding.go b/healthchecks/rolebinding.go
new file mode 100644
index 0000000..a97c4b4
--- /dev/null
+++ b/healthchecks/rolebinding.go
@@ -0,0 +1,14 @@
+package healthchecks
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func registerRoleBindingHealthCheck() {
+	gvk := schema.GroupVersionKind{
+		Group:   "rbac.authorization.k8s.io",
+		Version: "v1",
+		Kind:    "RoleBinding",
+	}
+	RegisterHealthCheck(gvk, alwaysReady)
+}