12 Service Accounts
4 Workloads
65 Bindings
4 Critical
2 Medium
59 Low
Description
The Dynatrace Operator Helm chart for Kubernetes and OpenShift
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
dynatrace-dynakube-oneagent | default | ✅ | — | 2 | 0 | Critical |
dynatrace-logmonitoring | default | ❌ | — | 2 | 0 | Critical |
dynatrace-oneagent-csi-driver | default | ❌ | — | 6 | 4 | Critical |
dynatrace-webhook | default | ❌ | — | 21 | 1 | Critical |
dynatrace-crd-storage-migration | default | ❌ | — | 4 | 1 | Low |
dynatrace-extension-controller | default | ❌ | — | 1 | 0 | Low |
dynatrace-operator | default | ❌ | — | 15 | 1 | Low |
dynatrace-otel-collector | default | ❌ | — | 14 | 0 | Low |
dynatrace-activegate | default | ❌ | — | 0 | 0 | — |
dynatrace-edgeconnect | default | ❌ | — | 0 | 0 | — |
dynatrace-node-config-collector | default | ❌ | — | 0 | 0 | — |
dynatrace-sql-ext-exec | default | ❌ | — | 0 | 0 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 dynatrace-webhook
Namespace: default | Automount: ❌
🔑 Permissions (21)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role dynatrace-webhook | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role dynatrace-webhook | core/configmaps | get · list · watch | Medium | ConfigMapAccess DataExposure InformationDisclosure |
ClusterRole dynatrace-webhook | batch/cronjobs | get | Low | |
ClusterRole dynatrace-webhook | apps/daemonsets | get | Low | |
ClusterRole dynatrace-webhook | apps.openshift.io/deploymentconfigs | get | Low | |
ClusterRole dynatrace-webhook | apps/deployments | get | Low | |
Role dynatrace-webhook | dynatrace.com/dynakubes | get · list · watch | Low | |
Role dynatrace-webhook | core/events | create · patch | Low | |
ClusterRole dynatrace-webhook | batch/jobs | get | Low | |
ClusterRole dynatrace-webhook | core/namespaces | get · list · update · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
Role dynatrace-webhook | core/pods | get · list · watch | Low | |
ClusterRole dynatrace-webhook | apps/replicasets | get | Low | |
ClusterRole dynatrace-webhook | core/replicationcontrollers | get | Low | |
ClusterRole dynatrace-webhook | core/secrets | create | Low | |
ClusterRole dynatrace-webhook | apps/statefulsets | get | Low | |
ClusterRole dynatrace-webhook | core/secrets (restricted to: dynatrace-bootstrapper-certs) | get · list · update · watch | Low | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted (+1 more) |
ClusterRole dynatrace-webhook | core/secrets (restricted to: dynatrace-bootstrapper-config) | get · list · update · watch | Low | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted (+1 more) |
ClusterRole dynatrace-webhook | core/secrets (restricted to: dynatrace-dynakube-config) | get · list · update · watch | Low | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted (+1 more) |
ClusterRole dynatrace-webhook | core/secrets (restricted to: dynatrace-metadata-enrichment-endpoint) | get · list · update · watch | Low | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted (+1 more) |
ClusterRole dynatrace-webhook | core/secrets (restricted to: dynatrace-otlp-exporter-certs) | get · list · update · watch | Low | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted (+1 more) |
ClusterRole dynatrace-webhook | core/secrets (restricted to: dynatrace-otlp-exporter-config) | get · list · update · watch | Low | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted (+1 more) |
⚠️ Potential Abuse (5)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps in a namespace
- List Namespaces (Cluster Reconnaissance)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | dynatrace-webhook | webhook | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
🤖 dynatrace-oneagent-csi-driver
Namespace: default | Automount: ❌
🔑 Permissions (6)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role dynatrace-oneagent-csi-driver | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role dynatrace-oneagent-csi-driver | core/configmaps | get · list · watch | Medium | ConfigMapAccess DataExposure InformationDisclosure |
Role dynatrace-oneagent-csi-driver | dynatrace.com/dynakubes | get · list · watch | Low | |
Role dynatrace-oneagent-csi-driver | dynatrace.com/dynakubes/finalizers | update | Low | |
Role dynatrace-oneagent-csi-driver | core/events | create · patch | Low | |
Role dynatrace-oneagent-csi-driver | batch/jobs | create · delete · get · list · watch | Low |
⚠️ Potential Abuse (3)
The following security risks were found based on the above permissions:
📦 Workloads (4)
| Kind | Name | Container | Image |
|---|---|---|---|
| DaemonSet | dynatrace-oneagent-csi-driver | liveness-probe | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
| DaemonSet | dynatrace-oneagent-csi-driver | provisioner | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
| DaemonSet | dynatrace-oneagent-csi-driver | registrar | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
| DaemonSet | dynatrace-oneagent-csi-driver | server | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
🤖 dynatrace-dynakube-oneagent
Namespace: default | Automount: ✅
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole dynatrace-logmonitoring | core/nodes/proxy | get | Critical | ClusterAdminAccess CodeExecution ElevationOfPrivilege LateralMovement (+1 more) |
ClusterRole dynatrace-logmonitoring | security.openshift.io/securitycontextconstraints (restricted to: privileged) | use | Low | ResourceNameRestricted |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-logmonitoring
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole dynatrace-logmonitoring | core/nodes/proxy | get | Critical | ClusterAdminAccess CodeExecution ElevationOfPrivilege LateralMovement (+1 more) |
ClusterRole dynatrace-logmonitoring | security.openshift.io/securitycontextconstraints (restricted to: privileged) | use | Low | ResourceNameRestricted |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-operator
Namespace: default | Automount: ❌
🔑 Permissions (15)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole dynatrace-operator | core/namespaces | get · list · update · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole dynatrace-operator | core/nodes | get · list · watch | Low | |
ClusterRole dynatrace-operator | core/secrets | create | Low | |
ClusterRole dynatrace-operator | apiextensions.k8s.io/customresourcedefinitions (restricted to: dynakubes.dynatrace.com) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | apiextensions.k8s.io/customresourcedefinitions/status (restricted to: dynakubes.dynatrace.com) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | core/secrets (restricted to: dynatrace-bootstrapper-certs) | delete · get · list · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | core/secrets (restricted to: dynatrace-bootstrapper-config) | delete · get · list · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | core/secrets (restricted to: dynatrace-dynakube-config) | delete · get · list · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | core/secrets (restricted to: dynatrace-metadata-enrichment-endpoint) | delete · get · list · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | core/secrets (restricted to: dynatrace-otlp-exporter-certs) | delete · get · list · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | core/secrets (restricted to: dynatrace-otlp-exporter-config) | delete · get · list · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | admissionregistration.k8s.io/mutatingwebhookconfigurations (restricted to: dynatrace-webhook) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | admissionregistration.k8s.io/validatingwebhookconfigurations (restricted to: dynatrace-webhook) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | apiextensions.k8s.io/customresourcedefinitions (restricted to: edgeconnects.dynatrace.com) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-operator | apiextensions.k8s.io/customresourcedefinitions/status (restricted to: edgeconnects.dynatrace.com) | get · update | Low | ResourceNameRestricted |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | dynatrace-operator | operator | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
🤖 dynatrace-otel-collector
Namespace: default | Automount: ❌
🔑 Permissions (14)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole dynatrace-extensions-prometheus | apps/daemonsets | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | apps/deployments | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | core/endpoints | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole dynatrace-telemetry-ingest | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole dynatrace-extensions-prometheus | core/nodes | get · list · watch | Low | |
ClusterRole dynatrace-telemetry-ingest | core/nodes | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | core/nodes/metrics | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | core/pods | get · list · watch | Low | |
ClusterRole dynatrace-telemetry-ingest | core/pods | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | apps/replicasets | get · list · watch | Low | |
ClusterRole dynatrace-telemetry-ingest | apps/replicasets | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | core/services | get · list · watch | Low | |
ClusterRole dynatrace-extensions-prometheus | apps/statefulsets | get · list · watch | Low |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-crd-storage-migration
Namespace: default | Automount: ❌
🔑 Permissions (4)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole dynatrace-crd-storage-migration | apiextensions.k8s.io/customresourcedefinitions (restricted to: dynakubes.dynatrace.com) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-crd-storage-migration | apiextensions.k8s.io/customresourcedefinitions/status (restricted to: dynakubes.dynatrace.com) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-crd-storage-migration | apiextensions.k8s.io/customresourcedefinitions (restricted to: edgeconnects.dynatrace.com) | get · update | Low | ResourceNameRestricted |
ClusterRole dynatrace-crd-storage-migration | apiextensions.k8s.io/customresourcedefinitions/status (restricted to: edgeconnects.dynatrace.com) | get · update | Low | ResourceNameRestricted |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | dynatrace-operator-crd-storage-migration | crd-storage-migration | public.ecr.aws/dynatrace/dynatrace-operator:v1.8.0 |
🤖 dynatrace-extension-controller
Namespace: default | Automount: ❌
🔑 Permissions (1)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role dynatrace-extension-controller-database | core/pods | list | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-activegate
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-edgeconnect
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-node-config-collector
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (0)
No workloads use this ServiceAccount.
🤖 dynatrace-sql-ext-exec
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (0)
No workloads use this ServiceAccount.