gitlab

Description

GitLab is the most comprehensive AI-powered DevSecOps Platform.

• https://gitlab.com/gitlab-org/charts/gitlab

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 gitlab-cert-manager

Namespace: default  |  Automount: ✅

🔑 Permissions (56)

⚠️ Potential Abuse (9)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Create SubjectAccessReviews (check arbitrary permissions)
• Update CertificateSigningRequest Status (Tampering/DoS)

📦 Workloads (1)

🤖 gitlab-nginx-ingress

Namespace: default  |  Automount: ✅

🔑 Permissions (24)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read secrets in a namespace
• Read ConfigMaps in a namespace

📦 Workloads (1)

🤖 gitlab-kubernetes-ingress

Namespace: default  |  Automount: ❌

🔑 Permissions (18)

⚠️ Potential Abuse (8)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Read events cluster-wide
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 gitlab-traefik

Namespace: default  |  Automount: ❌

🔑 Permissions (18)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace

📦 Workloads (1)

🤖 gitlab-cert-manager-cainjector

Namespace: default  |  Automount: ✅

🔑 Permissions (8)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)

📦 Workloads (1)

🤖 gitlab-cert-manager-webhook

Namespace: default  |  Automount: ✅

🔑 Permissions (2)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read secrets in a namespace
• Create SubjectAccessReviews (check arbitrary permissions)

📦 Workloads (1)

🤖 gitlab-gitlab-runner

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (17)

The following security risks were found based on the above permissions:

• Namespaced pod exec
• Namespaced pod attach
• Namespaced pod port-forward
• Create pods in a namespace
• Update/Patch pods in a namespace
• Read secrets in a namespace
• Modify secrets in a namespace
• Read pod logs in a namespace
• Manage ephemeral containers in a namespace
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Manage ServiceAccounts in a namespace
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services in a namespace
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)

📦 Workloads (1)

🤖 gitlab-prometheus-server

Namespace: default  |  Automount: ❌

🔑 Permissions (13)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (2)

🤖 gitlab-kube-state-metrics

Namespace: default  |  Automount: ✅

🔑 Permissions (32)

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)

📦 Workloads (1)

🤖 gitlab-cert-manager-startupapicheck

Namespace: default  |  Automount: ✅

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 gitlab-certmanager-issuer

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 gitlab-shared-secrets

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 gitlab-alertmanager

Namespace: default  |  Automount: ✅

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 gitlab-gitlab-zoekt

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (3)

🤖 gitlab-postgresql

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (2)

🤖 gitlab-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 gitlab-prometheus-pushgateway

Namespace: default  |  Automount: ✅

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 gitlab-redis-master

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (2)