datadog

Description

Datadog Agent

• https://app.datadoghq.com/account/settings#agent/kubernetes
• https://github.com/DataDog/datadog-agent

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 datadog-datadog-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (92)

⚠️ Potential Abuse (48)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage ClusterRoles (create, update, patch, delete)
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage MutatingWebhookConfigurations
• Manage ValidatingWebhookConfigurations
• Manage APIServices
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Read events cluster-wide
• Manage NetworkPolicies cluster-wide
• Manage NetworkPolicies in a namespace
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• Manage PodDisruptionBudgets cluster-wide
• Manage Leases cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)
• Read ComponentStatuses (Control Plane Reconnaissance)
• Node proxy GET RCE via WebSocket

📦 Workloads (1)

🤖 datadog-cluster-agent

Namespace: default  |  Automount: ✅

🔑 Permissions (90)

⚠️ Potential Abuse (15)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Read events cluster-wide
• Read RBAC configuration cluster-wide
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)
• Read ComponentStatuses (Control Plane Reconnaissance)

📦 Workloads (1)

🤖 datadog-kube-state-metrics

Namespace: default  |  Automount: ❌

🔑 Permissions (31)

⚠️ Potential Abuse (11)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (1)

🤖 datadog

Namespace: default  |  Automount: ✅

🔑 Permissions (11)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Node proxy GET RCE via WebSocket

📦 Workloads (0)

No workloads use this ServiceAccount.