gitlab-operator

Description

The GitLab operator aims to manage the full lifecycle of GitLab instances in your Kubernetes or Openshift container platforms.

• https://gitlab.com/gitlab-org/cloud-native/gitlab-operator

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 gitlab-operator-cert-manager

Namespace: default  |  Automount: ✅

🔑 Permissions (61)

⚠️ Potential Abuse (6)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Create SubjectAccessReviews (check arbitrary permissions)

📦 Workloads (1)

🤖 gitlab-manager

Namespace: default  |  Automount: ❌

🔑 Permissions (31)

⚠️ Potential Abuse (32)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Delete namespaces
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Manage Leases in kube-system or kube-node-lease namespace
• List Namespaces (Cluster Reconnaissance)
• Manage Ingresses (Namespace Service Exposure/Traffic Redirection)

📦 Workloads (1)

🤖 gitlab-nginx-ingress

Namespace: default  |  Automount: ❌

🔑 Permissions (25)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read secrets in a namespace
• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 gitlab-operator-cert-manager-cainjector

Namespace: default  |  Automount: ✅

🔑 Permissions (14)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)

📦 Workloads (1)

🤖 gitlab-prometheus-server

Namespace: default  |  Automount: ❌

🔑 Permissions (12)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 gitlab-operator-cert-manager-webhook

Namespace: default  |  Automount: ✅

🔑 Permissions (3)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read secrets in a namespace
• Create SubjectAccessReviews (check arbitrary permissions)

📦 Workloads (1)

🤖 gitlab-app-nonroot

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 gitlab-operator-cert-manager-startupapicheck

Namespace: default  |  Automount: ✅

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)