1 Service Accounts
1 Workloads
72 Bindings
14 Critical
7 High
6 Medium
45 Low
Description
Datadog Operator
Overview
Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
---|---|---|---|---|---|---|
datadog-operator | default | ❌ | — | 72 | 1 | Critical |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 datadog-operator
Namespace: default
| Automount: ❌
🔑 Permissions (72)
Role | Resource | Verbs | Risk | Tags |
---|---|---|---|---|
ClusterRole datadog-operator | apiregistration.k8s.io/apiservices | * · deletecollection · list · watch | Critical | APIServiceManipulation ClusterWideAccess DenialOfService InformationDisclosure PrivilegeEscalation (+2 more) |
ClusterRole datadog-operator | rbac.authorization.k8s.io/clusterrolebindings | create · delete · deletecollection · get · list · patch · update · watch | Critical | BindingToPrivilegedRole ClusterAdminAccess InformationDisclosure PrivilegeEscalation RBACManipulation (+2 more) |
ClusterRole datadog-operator | rbac.authorization.k8s.io/clusterroles | create · delete · deletecollection · get · list · patch · update · watch | Critical | ClusterAdminAccess InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery (+1 more) |
ClusterRole datadog-operator | core/configmaps | create · delete · get · list · patch · update · watch | Critical | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
ClusterRole datadog-operator | apps/daemonsets | create · delete · get · list · patch · update · watch | Critical | NodeAccess Persistence PrivilegeEscalation Tampering WorkloadLifecycle |
ClusterRole datadog-operator | apps/deployments | create · delete · get · list · patch · update · watch | Critical | Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering WorkloadLifecycle |
ClusterRole datadog-operator | core/endpoints | create · delete · get · list · patch · update · watch | Critical | DenialOfService ManInTheMiddle NetworkManipulation Tampering TrafficRedirection |
ClusterRole datadog-operator | coordination.k8s.io/leases | create · delete · get · list · patch · update · watch | Critical | ControlPlaneDisruption CriticalNamespace DenialOfService LeaderElectionAbuse Tampering |
ClusterRole datadog-operator | admissionregistration.k8s.io/mutatingwebhookconfigurations | * | Critical | ClusterWideAccess DenialOfService InformationDisclosure PrivilegeEscalation Reconnaissance (+4 more) |
ClusterRole datadog-operator | networking.k8s.io/networkpolicies | create · delete · get · list · patch · update · watch | Critical | DenialOfService LateralMovement NetworkManipulation NetworkPolicyManagement Tampering |
ClusterRole datadog-operator | core/pods | create · delete · get · list · patch · update · watch | Critical | LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+1 more) |
ClusterRole datadog-operator | core/secrets | create · delete · get · list · patch · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure Persistence (+4 more) |
ClusterRole datadog-operator | core/services | create · delete · get · list · patch · update · watch | Critical | DenialOfService NetworkManipulation ServiceExposure Tampering |
ClusterRole datadog-operator | admissionregistration.k8s.io/validatingwebhookconfigurations | * | Critical | ClusterWideAccess DenialOfService InformationDisclosure Reconnaissance Tampering (+3 more) |
ClusterRole datadog-operator | external.metrics.k8s.io/* | get · list · watch | High | ClusterWideAccess |
ClusterRole datadog-operator | //scale | get · update | High | ClusterWideAccess |
ClusterRole datadog-operator | datadoghq.com/datadogpodautoscalers | * | High | ClusterWideAccess |
ClusterRole datadog-operator | datadoghq.com/datadogpodautoscalers/status | * | High | ClusterWideAccess |
ClusterRole datadog-operator | rbac.authorization.k8s.io/rolebindings | create · delete · get · list · patch · update · watch | High | BindingToPrivilegedRole InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery (+1 more) |
ClusterRole datadog-operator | rbac.authorization.k8s.io/roles | create · delete · get · list · patch · update · watch | High | InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery Reconnaissance |
ClusterRole datadog-operator | core/serviceaccounts | create · delete · get · list · patch · update · watch | High | IdentityManagement PotentialPrivilegeEscalation Tampering |
ClusterRole datadog-operator | core/componentstatuses | get · list · watch | Medium | ControlPlaneDisruption InformationDisclosure Reconnaissance |
ClusterRole datadog-operator | core/events | create · delete · get · list · patch · update · watch | Medium | InformationDisclosure OperationalData Reconnaissance |
ClusterRole datadog-operator | policy/poddisruptionbudgets | create · delete · get · list · patch · update · watch | Medium | AvailabilityImpact DenialOfService Tampering |
ClusterRole datadog-operator | core/resourcequotas | get · list · watch | Medium | InformationDisclosure QuotaTampering Reconnaissance ResourceConfiguration |
ClusterRole datadog-operator | authorization.k8s.io/subjectaccessreviews | create · get | Medium | InformationDisclosure RBACQuery |
ClusterRole datadog-operator | authentication.k8s.io/tokenreviews | create · get · list · watch | Medium | CredentialAccess InformationDisclosure RBACQuery |
ClusterRole datadog-operator | certificates.k8s.io/certificatesigningrequests | get · list · watch | Low | |
ClusterRole datadog-operator | cilium.io/ciliumnetworkpolicies | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | quota.openshift.io/clusterresourcequotas | get · list | Low | |
ClusterRole datadog-operator | batch/cronjobs | get · list · watch | Low | |
ClusterRole datadog-operator | apiextensions.k8s.io/customresourcedefinitions | list · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogagents | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogagents/finalizers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogagents/status | get · patch · update | Low | |
ClusterRole datadog-operator | datadoghq.com/datadoggenericresources | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadoggenericresources/finalizers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadoggenericresources/status | get · patch · update | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogmetrics | create · delete · get · list · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogmetrics/status | update | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogmonitors | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogmonitors/finalizers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogmonitors/status | get · patch · update | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogslos | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogslos/finalizers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/datadogslos/status | get · patch · update | Low | |
ClusterRole datadog-operator | core/deployments | get · list · watch | Low | |
ClusterRole datadog-operator | discovery.k8s.io/endpointslices | list · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/extendeddaemonsetreplicasets | get · list · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/extendeddaemonsets | create · delete · get · list · patch · update · watch | Low | |
ClusterRole datadog-operator | autoscaling/horizontalpodautoscalers | list · watch | Low | |
ClusterRole datadog-operator | networking.k8s.io/ingresses | list · watch | Low | |
ClusterRole datadog-operator | batch/jobs | get · list · watch | Low | |
ClusterRole datadog-operator | metrics.eks.amazonaws.com/kcm/metrics | get | Low | |
ClusterRole datadog-operator | metrics.eks.amazonaws.com/ksh/metrics | get | Low | |
ClusterRole datadog-operator | core/limitranges | get · list · watch | Low | InformationDisclosure Reconnaissance ResourceConfiguration |
ClusterRole datadog-operator | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole datadog-operator | core/nodes | get · list · watch | Low | |
ClusterRole datadog-operator | core/nodes/metrics | get | Low | |
ClusterRole datadog-operator | core/nodes/proxy | get | Low | |
ClusterRole datadog-operator | core/nodes/spec | get | Low | |
ClusterRole datadog-operator | core/nodes/stats | get | Low | |
ClusterRole datadog-operator | core/persistentvolumeclaims | get · list · watch | Low | |
ClusterRole datadog-operator | core/persistentvolumes | get · list · watch | Low | |
ClusterRole datadog-operator | apps/replicasets | get · list · watch | Low | |
ClusterRole datadog-operator | core/replicationcontrollers | get · list · watch | Low | |
ClusterRole datadog-operator | apps/statefulsets | get · list · watch | Low | |
ClusterRole datadog-operator | storage.k8s.io/storageclasses | get · list · watch | Low | |
ClusterRole datadog-operator | autoscaling.k8s.io/verticalpodautoscalers | list · watch | Low | |
ClusterRole datadog-operator | storage.k8s.io/volumeattachments | get · list · watch | Low | |
ClusterRole datadog-operator | datadoghq.com/watermarkpodautoscalers | get · list · watch | Low | |
ClusterRole datadog-operator | security.openshift.io/securitycontextconstraints (restricted to: restricted) | use | Low | ResourceNameRestricted |
⚠️ Potential Abuse (47)
The following security risks were found based on the above permissions:
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps cluster-wide
- Modify ConfigMaps in a namespace
- Manage ClusterRoles (create, update, patch, delete)
- Manage ClusterRoleBindings (create, update, patch, delete)
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments cluster-wide (potential for privileged pod execution)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets cluster-wide (runs on all nodes, high impact)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage MutatingWebhookConfigurations
- Manage ValidatingWebhookConfigurations
- Manage APIServices
- Create TokenReviews (validate arbitrary tokens)
- Create SubjectAccessReviews (check arbitrary permissions)
- Manage ServiceAccounts cluster-wide
- Manage ServiceAccounts in a namespace
- Read events cluster-wide
- Manage NetworkPolicies cluster-wide
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices cluster-wide
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services cluster-wide
- Manage Services in a namespace
- Read RBAC configuration cluster-wide
- Manage PodDisruptionBudgets cluster-wide
- Manage Leases cluster-wide
- Manage Leases in kube-system or kube-node-lease namespace
- List Namespaces (Cluster Reconnaissance)
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Read All ResourceQuotas (Cluster-wide Information Disclosure)
- Read ComponentStatuses (Control Plane Reconnaissance)
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
Deployment | datadog-operator | datadog-operator | gcr.io/datadoghq/operator:1.16.0 |