solr-operator

Description

The Solr Operator enables easy management of Solr resources within Kubernetes.

• https://github.com/apache/solr-operator

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 solr-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (30)

⚠️ Potential Abuse (20)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Manage PodDisruptionBudgets cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• Manage Ingresses (Namespace Service Exposure/Traffic Redirection)

📦 Workloads (1)

🤖 zookeeper-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (15)

⚠️ Potential Abuse (30)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Modify node configuration (labels, taints)
• Delete nodes
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Impersonate users, groups, or service accounts (cluster-wide)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Manage PodDisruptionBudgets cluster-wide

📦 Workloads (1)

🤖 solr-operator-zookeeper-operator-pre-delete

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 solr-operator-zookeeper-operator-post-install-upgrade

Namespace: default  |  Automount: ❌

🔑 Permissions (2)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

📦 Workloads (1)