1 Service Accounts
1 Workloads
4 Bindings
4 Low
Description
Helm chart for deploying a multi-tenant etcd cluster.
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
etcd | default | ❌ | — | 4 | 4 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 etcd
Namespace: default | Automount: ❌
🔑 Permissions (4)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role etcd-gen-certs-role | core/secrets | create | Low | |
Role etcd-gen-certs-role | apps/statefulsets | get · list · watch | Low | |
Role etcd-gen-certs-role | core/secrets (restricted to: etcd-certs) | delete | Low | ResourceNameRestricted |
Role etcd-gen-certs-role | core/secrets (restricted to: root-client-certs) | delete | Low | ResourceNameRestricted |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (4)
| Kind | Name | Container | Image |
|---|---|---|---|
| CronJob | kamaji-etcd-defrag | etcd-client | quay.io/coreos/etcd:v3.5.4 |
| Job | kamaji-etcd-etcd-setup | etcd-client | quay.io/coreos/etcd:v3.5.4 |
| Job | kamaji-etcd-etcd-teardown | kubectl | clastix/kubectl:v1.20 |
| StatefulSet | etcd | etcd | quay.io/coreos/etcd:v3.5.4 |