kubevault-operator

Description

KubeVault Operator by AppsCode - HashiCorp Vault operator for Kubernetes

• https://github.com/kubevault

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

kubevault-operator

Namespace: default  |  Automount:

Permissions (39)

Potential Abuse (20)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods cluster-wide
• Create pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Manage ClusterRoles (create, update, patch, delete)
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage CustomResourceDefinitions
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Manage ClusterIssuers (cert-manager.io)
• Read RBAC configuration cluster-wide
• List Namespaces (Cluster Reconnaissance)

Workloads (1)