airflow
Description
The official Helm chart to deploy Apache Airflow, a platform to programmatically author, schedule, and monitor workflows
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
airflow-worker | default | ✅ | — | 4 | 2 | High |
airflow-triggerer | default | ✅ | — | 2 | 2 | Medium |
airflow-webserver | default | ✅ | — | 2 | 1 | Medium |
airflow-create-user-job | default | ✅ | — | 0 | 1 | — |
airflow-migrate-database-job | default | ✅ | — | 0 | 1 | — |
airflow-redis | default | ✅ | — | 0 | 1 | — |
airflow-scheduler | default | ✅ | — | 0 | 2 | — |
airflow-statsd | default | ✅ | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 airflow-worker
Namespace: default | Automount: ✅
🔑 Permissions (4)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role airflow-pod-launcher-role | core/pods | create · delete · get · list · patch · watch | High | LateralMovement Persistence PotentialPrivilegeEscalation WorkloadExecution |
Role airflow-pod-launcher-role | core/pods/exec | create · get | High | CodeExecution LateralMovement PodExec PotentialPrivilegeEscalation |
Role airflow-pod-launcher-role | core/pods/log | get | Medium | DataExposure InformationDisclosure LogAccess |
Role airflow-pod-launcher-role | core/events | list | Low |
⚠️ Potential Abuse (4)
The following security risks were found based on the above permissions:
📦 Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | airflow-worker | worker | apache/airflow:2.10.5 |
| StatefulSet | airflow-worker | worker-log-groomer | apache/airflow:2.10.5 |
🤖 airflow-triggerer
Namespace: default | Automount: ✅
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role airflow-pod-log-reader-role | core/pods/log | get · list | Medium | DataExposure InformationDisclosure LogAccess |
Role airflow-pod-log-reader-role | core/pods | get · list · watch | Low |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | airflow-triggerer | triggerer | apache/airflow:2.10.5 |
| StatefulSet | airflow-triggerer | triggerer-log-groomer | apache/airflow:2.10.5 |
🤖 airflow-webserver
Namespace: default | Automount: ✅
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role airflow-pod-log-reader-role | core/pods/log | get · list | Medium | DataExposure InformationDisclosure LogAccess |
Role airflow-pod-log-reader-role | core/pods | get · list · watch | Low |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | airflow-webserver | webserver | apache/airflow:2.10.5 |
🤖 airflow-create-user-job
Namespace: default | Automount: ✅
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | airflow-create-user | create-user | apache/airflow:2.10.5 |
🤖 airflow-migrate-database-job
Namespace: default | Automount: ✅
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | airflow-run-airflow-migrations | run-airflow-migrations | apache/airflow:2.10.5 |
🤖 airflow-redis
Namespace: default | Automount: ✅
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | airflow-redis | redis | redis:7.2-bookworm |
🤖 airflow-scheduler
Namespace: default | Automount: ✅
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | airflow-scheduler | scheduler | apache/airflow:2.10.5 |
| Deployment | airflow-scheduler | scheduler-log-groomer | apache/airflow:2.10.5 |
🤖 airflow-statsd
Namespace: default | Automount: ✅
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | airflow-statsd | statsd | quay.io/prometheus/statsd-exporter:v0.28.0 |