kubestash-operator

Description

KubeStash, Kubernetes native backup operator by AppsCode

• https://github.com/stashed

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 kubestash-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (49)

⚠️ Potential Abuse (27)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Manage ClusterRoles (create, update, patch, delete)
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage MutatingWebhookConfigurations
• Manage ValidatingWebhookConfigurations
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Read RBAC configuration cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)

📦 Workloads (3)

🤖 kubestash-operator-cleaner

Namespace: default  |  Automount: ❌

🔑 Permissions (6)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

📦 Workloads (1)