loki

Description

Helm chart for Grafana Loki and Grafana Enterprise Logs supporting monolithic, simple scalable, and microservices modes.

• https://github.com/grafana/loki
• https://grafana.com/oss/loki/
• https://grafana.com/docs/loki/latest/

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 loki-grafana-agent-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (25)

⚠️ Potential Abuse (20)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 grafana-agent-test-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (7)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Node proxy GET RCE via WebSocket

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 loki

Namespace: default  |  Automount: ✅

🔑 Permissions (2)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (9)

🤖 loki-rollout-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (4)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)

📦 Workloads (1)

🤖 loki-canary

Namespace: default  |  Automount: ✅

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 minio-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (3)