consul
v1.7.1
5 Service Accounts
6 Workloads
74 Bindings
3 Critical
1 High
4 Medium
66 Low
Description
Official HashiCorp Consul Chart
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
consul-consul-connect-injector | default | ❌ | — | 65 | 1 | Critical |
consul-consul-webhook-cert-manager | default | ❌ | — | 4 | 1 | Critical |
consul-consul-gateway-cleanup | default | ❌ | — | 2 | 1 | Low |
consul-consul-gateway-resources | default | ❌ | — | 2 | 1 | Low |
consul-consul-server | default | ❌ | — | 1 | 1 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 consul-consul-connect-injector
Namespace: default | Automount: ❌
🔑 Permissions (65)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole consul-consul-connect-injector | policy/podsecuritypolicies | use | Critical | DeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation |
ClusterRole consul-consul-connect-injector | core/secrets | create · delete · get · list · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role consul-consul-connect-inject-leader-election | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
ClusterRole consul-consul-connect-injector | rbac.authorization.k8s.io/rolebindings | create · delete · get · list · update · watch | Medium | InformationDisclosure RBACQuery Reconnaissance |
ClusterRole consul-consul-connect-injector | rbac.authorization.k8s.io/roles | create · delete · get · list · update · watch | Medium | InformationDisclosure RBACQuery Reconnaissance |
Role consul-consul-connect-inject-leader-election | core/configmaps/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/controlplanerequestlimits | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/controlplanerequestlimits/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | apps/deployments | create · delete · get · list · update · watch | Low | |
ClusterRole consul-consul-connect-injector | core/endpoints | get · list · watch | Low | |
Role consul-consul-connect-inject-leader-election | core/events | create · patch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/exportedservices | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/exportedservices/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/gatewayclassconfigs | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/gatewayclasses | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/gatewayclasses/finalizers | update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/gatewayclasses/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/gatewaypolicies | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/gatewaypolicies/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/gateways | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/gateways/finalizers | update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/gateways/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/httproutes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/httproutes/finalizers | update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/httproutes/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/ingressgateways | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/ingressgateways/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/jwtproviders | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/jwtproviders/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | coordination.k8s.io/leases | create · get · list · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/meshes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/meshes/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/meshservices | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole consul-consul-connect-injector | core/nodes | get · list · watch | Low | |
ClusterRole consul-consul-connect-injector | core/pods | get · list · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/proxydefaults | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/proxydefaults/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/referencegrants | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/registrations | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/registrations/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/routeauthfilters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/routeauthfilters/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/routeretryfilters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/routetimeoutfilters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/samenessgroups | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/samenessgroups/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | core/serviceaccounts | create · delete · get · list · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/servicedefaults | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/servicedefaults/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/serviceintentions | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/serviceintentions/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/serviceresolvers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/serviceresolvers/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/servicerouters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/servicerouters/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | core/services | list · watch | Low | |
ClusterRole consul-consul-connect-injector | core/services | create · delete · get · list · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/servicesplitters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/servicesplitters/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/tcproutes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/tcproutes/finalizers | update | Low | |
ClusterRole consul-consul-connect-injector | gateway.networking.k8s.io/tcproutes/status | get · patch · update | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/terminatinggateways | create · delete · get · list · patch · update · watch | Low | |
ClusterRole consul-consul-connect-injector | consul.hashicorp.com/terminatinggateways/status | get · patch · update | Low |
⚠️ Potential Abuse (8)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Read RBAC configuration cluster-wide
- Use privileged PodSecurityPolicy (deprecated)
- List Namespaces (Cluster Reconnaissance)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | consul-consul-connect-injector | sidecar-injector | hashicorp/consul-k8s-control-plane:1.7.1 |
🤖 consul-consul-webhook-cert-manager
Namespace: default | Automount: ❌
🔑 Permissions (4)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole consul-consul-webhook-cert-manager | core/secrets | create · delete · get · list · patch · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure Persistence (+4 more) |
ClusterRole consul-consul-webhook-cert-manager | admissionregistration.k8s.io/mutatingwebhookconfigurations | get · list · patch · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole consul-consul-webhook-cert-manager | admissionregistration.k8s.io/validatingwebhookconfigurations | get · list · patch · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole consul-consul-webhook-cert-manager | apps/deployments | get | Low |
⚠️ Potential Abuse (7)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | consul-consul-webhook-cert-manager | webhook-cert-manager | hashicorp/consul-k8s-control-plane:1.7.1 |
🤖 consul-consul-gateway-cleanup
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole consul-consul-gateway-cleanup | consul.hashicorp.com/gatewayclassconfigs | delete · get | Low | |
ClusterRole consul-consul-gateway-cleanup | gateway.networking.k8s.io/gatewayclasses | delete · get | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | consul-consul-gateway-cleanup | gateway-cleanup | hashicorp/consul-k8s-control-plane:1.7.1 |
🤖 consul-consul-gateway-resources
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole consul-consul-gateway-resources | consul.hashicorp.com/gatewayclassconfigs | create · get · update | Low | |
ClusterRole consul-consul-gateway-resources | gateway.networking.k8s.io/gatewayclasses | create · get · update | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | consul-consul-gateway-resources | gateway-resources | hashicorp/consul-k8s-control-plane:1.7.1 |
🤖 consul-consul-server
Namespace: default | Automount: ❌
🔑 Permissions (1)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole consul-consul-server | core/nodes | get | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | consul-consul-server | consul | hashicorp/consul:1.21.1 |