2 Service Accounts
2 Workloads
7 Bindings
1 Critical
1 High
5 Low
Description
A Helm chart to install Argo-Events in k8s Cluster
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
argo-events | default | ❌ | — | 5 | 1 | Critical |
argo-signals | default | ❌ | — | 2 | 0 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 argo-events
Namespace: default | Automount: ❌
🔑 Permissions (5)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole -sensor-controller-cluster-role | core/secrets | get · list · patch · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole -sensor-controller-cluster-role | core/configmaps | get · list · patch · watch | High | ConfigMapAccess DataExposure InformationDisclosure |
ClusterRole -sensor-controller-cluster-role | core/pods | get · list · patch · watch | Low | |
ClusterRole -sensor-controller-cluster-role | argoproj.io/sensors | get · list · patch · update · watch | Low | |
ClusterRole -sensor-controller-cluster-role | argoproj.io/workflows | create · delete | Low |
⚠️ Potential Abuse (5)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | argo-events-sensor-controller | sensor-controller | argoproj/sensor-controller:latest |
🤖 argo-signals
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole -signals-cluster-role | core/pods | list · patch · watch | Low | |
ClusterRole -signals-cluster-role | argoproj.io/sensors workflows pods | get · list · watch | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (0)
No workloads use this ServiceAccount.