grafana-agent
v0.19.2
6 Service Accounts
7 Workloads
77 Bindings
4 Critical
2 High
4 Medium
67 Low
Description
Deploy an instance of the Grafana agent on all appropriate nodes for scraping Prometheus metrics.
- https://grafana.com/docs/agent/latest/
- https://github.com/DandyDeveloper/charts/blob/master/charts/grafana-agent
- https://github.com/hashicorp/consul
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
grafana-agent | default | ❌ | — | 5 | 1 | Critical |
grafana-agent-consul-connect-injector | default | ❌ | — | 63 | 1 | Critical |
grafana-agent-consul-webhook-cert-manager | default | ❌ | — | 4 | 1 | Critical |
grafana-agent-consul-gateway-cleanup | default | ❌ | — | 2 | 1 | Low |
grafana-agent-consul-gateway-resources | default | ❌ | — | 2 | 1 | Low |
grafana-agent-consul-server | default | ❌ | — | 1 | 1 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 grafana-agent-consul-connect-injector
Namespace: default | Automount: ❌
🔑 Permissions (63)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole grafana-agent-consul-connect-injector | policy/podsecuritypolicies | use | Critical | DeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation |
ClusterRole grafana-agent-consul-connect-injector | core/secrets | create · delete · get · list · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role grafana-agent-consul-connect-inject-leader-election | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
ClusterRole grafana-agent-consul-connect-injector | core/namespaces | create · delete · get · list · update · watch | High | ClusterStructure DenialOfService InformationDisclosure NamespaceLifecycle Reconnaissance (+1 more) |
ClusterRole grafana-agent-consul-connect-injector | rbac.authorization.k8s.io/rolebindings | create · delete · get · list · update · watch | Medium | InformationDisclosure RBACQuery Reconnaissance |
ClusterRole grafana-agent-consul-connect-injector | rbac.authorization.k8s.io/roles | create · delete · get · list · update · watch | Medium | InformationDisclosure RBACQuery Reconnaissance |
Role grafana-agent-consul-connect-inject-leader-election | core/configmaps/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/controlplanerequestlimits | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/controlplanerequestlimits/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | apps/deployments | create · delete · get · list · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | core/endpoints | create · delete · get · list · update · watch | Low | |
Role grafana-agent-consul-connect-inject-leader-election | core/events | create · patch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/exportedservices | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/exportedservices/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/gatewayclassconfigs | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/gatewayclasses | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/gatewayclasses/finalizers | update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/gatewayclasses/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/gatewaypolicies | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/gatewaypolicies/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/gateways | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/gateways/finalizers | update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/gateways/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/httproutes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/httproutes/finalizers | update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/httproutes/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/ingressgateways | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/ingressgateways/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/jwtproviders | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/jwtproviders/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | coordination.k8s.io/leases | create · get · list · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/meshes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/meshes/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/meshservices | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | core/nodes | create · delete · get · list · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | core/pods | get · list · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/proxydefaults | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/proxydefaults/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/referencegrants | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/routeauthfilters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/routeauthfilters/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/routeretryfilters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/routetimeoutfilters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/samenessgroups | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/samenessgroups/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | core/serviceaccounts | create · delete · get · list · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/servicedefaults | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/servicedefaults/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/serviceintentions | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/serviceintentions/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/serviceresolvers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/serviceresolvers/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/servicerouters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/servicerouters/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | core/services | create · delete · get · list · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | core/services | list · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/servicesplitters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/servicesplitters/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/tcproutes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/tcproutes/finalizers | update | Low | |
ClusterRole grafana-agent-consul-connect-injector | gateway.networking.k8s.io/tcproutes/status | get · patch · update | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/terminatinggateways | create · delete · get · list · patch · update · watch | Low | |
ClusterRole grafana-agent-consul-connect-injector | consul.hashicorp.com/terminatinggateways/status | get · patch · update | Low |
⚠️ Potential Abuse (9)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Delete namespaces
- Read RBAC configuration cluster-wide
- Use privileged PodSecurityPolicy (deprecated)
- List Namespaces (Cluster Reconnaissance)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | grafana-agent-consul-connect-injector | sidecar-injector | hashicorp/consul-k8s-control-plane:1.3.2 |
🤖 grafana-agent
Namespace: default | Automount: ❌
🔑 Permissions (5)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole grafana-agent | core/nodes/proxy | get · list · watch | Critical | ClusterAdminAccess CodeExecution ElevationOfPrivilege LateralMovement (+1 more) |
ClusterRole grafana-agent | core/endpoints | get · list · watch | Low | |
ClusterRole grafana-agent | core/nodes | get · list · watch | Low | |
ClusterRole grafana-agent | core/pods | get · list · watch | Low | |
ClusterRole grafana-agent | core/services | get · list · watch | Low |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| DaemonSet | grafana-agent | grafana-agent | grafana/agent:v0.20.0 |
🤖 grafana-agent-consul-webhook-cert-manager
Namespace: default | Automount: ❌
🔑 Permissions (4)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole grafana-agent-consul-webhook-cert-manager | core/secrets | create · delete · get · list · patch · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure Persistence (+4 more) |
ClusterRole grafana-agent-consul-webhook-cert-manager | admissionregistration.k8s.io/mutatingwebhookconfigurations | get · list · patch · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole grafana-agent-consul-webhook-cert-manager | admissionregistration.k8s.io/validatingwebhookconfigurations | get · list · patch · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole grafana-agent-consul-webhook-cert-manager | apps/deployments (restricted to: grafana-agent-consul-webhook-cert-manager) | get | Low | ResourceNameRestricted |
⚠️ Potential Abuse (7)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | grafana-agent-consul-webhook-cert-manager | webhook-cert-manager | hashicorp/consul-k8s-control-plane:1.3.2 |
🤖 grafana-agent-consul-gateway-cleanup
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole grafana-agent-consul-gateway-cleanup | consul.hashicorp.com/gatewayclassconfigs | delete · get | Low | |
ClusterRole grafana-agent-consul-gateway-cleanup | gateway.networking.k8s.io/gatewayclasses | delete · get | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | grafana-agent-consul-gateway-cleanup | gateway-cleanup | hashicorp/consul-k8s-control-plane:1.3.2 |
🤖 grafana-agent-consul-gateway-resources
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole grafana-agent-consul-gateway-resources | consul.hashicorp.com/gatewayclassconfigs | create · get · update | Low | |
ClusterRole grafana-agent-consul-gateway-resources | gateway.networking.k8s.io/gatewayclasses | create · get · update | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | grafana-agent-consul-gateway-resources | gateway-resources | hashicorp/consul-k8s-control-plane:1.3.2 |
🤖 grafana-agent-consul-server
Namespace: default | Automount: ❌
🔑 Permissions (1)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole grafana-agent-consul-server | core/nodes | get | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | grafana-agent-consul-server | consul | hashicorp/consul:1.17.2 |