loki :: RBAC ATLAS

Description

Helm chart for Grafana Enterprise Logs supporting monolithic, simple scalable, and microservices modes.

Overview

Identity	Namespace	Secrets	Permissions	Workloads	Risk	CVEs
`grafana-agent-test-sa`	default	—	7	0	Critical	—
`loki`	default	—	2	9	Critical	Exploited KEV 2 2 crit · 42 high
`loki-grafana-agent-operator`	default	—	25	1	Critical	Elevated 2 crit · 53 high
`loki-rollout-operator`	default	—	4	1	Medium	Moderate 0 crit · 5 high
`loki-canary`	default	—	0	1	—	Moderate 0 crit · 2 high
`minio-sa`	default	—	0	3	—	Elevated 3 crit · 17 high

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

`loki-grafana-agent-operator`

Namespace: default | Automount:

Permissions (25)

Role	Resource	Verbs	Risk	Tags
ClusterRole `loki-grafana-agent-operator`	core/configmaps	create · delete · get · list · patch · update · watch	Critical	ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering
ClusterRole `loki-grafana-agent-operator`	apps/daemonsets	create · delete · get · list · patch · update · watch	Critical	NodeAccess Persistence PrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole `loki-grafana-agent-operator`	apps/deployments	create · delete · get · list · patch · update · watch	Critical	Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole `loki-grafana-agent-operator`	core/endpoints	create · delete · get · list · patch · update · watch	Critical	DenialOfService ManInTheMiddle NetworkManipulation Tampering TrafficRedirection
ClusterRole `loki-grafana-agent-operator`	core/secrets	create · delete · get · list · patch · update · watch	Critical	ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure Persistence (+4 more)
ClusterRole `loki-grafana-agent-operator`	core/services	create · delete · get · list · patch · update · watch	Critical	DenialOfService NetworkManipulation ServiceExposure Tampering
ClusterRole `loki-grafana-agent-operator`	apps/statefulsets	create · delete · get · list · patch · update · watch	Critical	Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/grafanaagents	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/grafanaagents/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/integrations	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/integrations/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/logsinstances	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/logsinstances/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/metricsinstances	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/metricsinstances/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	core/namespaces	get · list · watch	Low	ClusterStructure InformationDisclosure Reconnaissance
ClusterRole `loki-grafana-agent-operator`	core/nodes	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/podlogs	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.grafana.com/podlogs/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.coreos.com/podmonitors	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.coreos.com/podmonitors/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.coreos.com/probes	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.coreos.com/probes/finalizers	get · list · update · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.coreos.com/servicemonitors	get · list · watch	Low
ClusterRole `loki-grafana-agent-operator`	monitoring.coreos.com/servicemonitors/finalizers	get · list · update · watch	Low

Potential Abuse (20)

The following security risks were found based on the above permissions:

Workloads (1)

Kind	Name	Container	Image
Deployment	loki-grafana-agent-operator	grafana-agent-operator	docker.io/grafana/agent-operator:v0.44.2 Elevated 2 critical · 53 high Top 8 of 270 CVEs CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3 CVE-2026-33186 Critical CVSS 9.1 google.golang.org/grpc fixed in 1.79.3 CVE-2026-46595 High CVSS 10.0 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39821 High CVSS 9.6 golang.org/x/net fixed in 0.55.0 CVE-2026-39830 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39831 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39832 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-42508 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 OS ubuntu 24.04 · fixable: 2 critical, 53 high · scanned 2026-11-11 as `docker.io/grafana/agent-operator:v0.44.2`

`grafana-agent-test-sa`

Namespace: default | Automount:

Permissions (7)

Role	Resource	Verbs	Risk	Tags
ClusterRole `grafana-agent-test-cr`	core/nodes/proxy	get · list · watch	Critical	AuthorizationBypass ClusterAdminAccess CodeExecution ElevationOfPrivilege LateralMovement (+1 more)
ClusterRole `grafana-agent-test-cr`	core/endpoints	get · list · watch	Low
ClusterRole `grafana-agent-test-cr`	networking.k8s.io/ingresses	get · list · watch	Low
ClusterRole `grafana-agent-test-cr`	core/nodes	get · list · watch	Low
ClusterRole `grafana-agent-test-cr`	core/nodes/metrics	get · list · watch	Low
ClusterRole `grafana-agent-test-cr`	core/pods	get · list · watch	Low
ClusterRole `grafana-agent-test-cr`	core/services	get · list · watch	Low

Potential Abuse (2)

The following security risks were found based on the above permissions:

Node proxy GET RCE via WebSocket

Workloads (0)

No workloads use this ServiceAccount.

`loki`

Namespace: default | Automount:

Permissions (2)

Role	Resource	Verbs	Risk	Tags
ClusterRole `loki-clusterrole`	core/secrets	get · list · watch	Critical	ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole `loki-clusterrole`	core/configmaps	get · list · watch	High	ConfigMapAccess DataExposure InformationDisclosure

Potential Abuse (5)

The following security risks were found based on the above permissions:

Workloads (9)

Kind	Name	Container	Image
Deployment	loki-gateway	nginx	docker.io/nginxinc/nginx-unprivileged:1.29-alpine Exploited KEV 2 1 critical · 41 high Top 8 of 145 CVEs CVE-2026-111497 Critical CVSS 9.8 KEV brotli-libs fixed in 1.2.1-r0 CVE-2026-125350 Unknown CVSS 8.8 KEV libxslt fixed in 1.1.43-r4 CVE-2026-8925 High CVSS 9.8 curl fixed in 8.22.0-r0 CVE-2026-9947 High CVSS 9.6 libxslt fixed in 1.1.43-r4 CVE-2026-8927 High CVSS 9.1 curl fixed in 8.22.0-r0 CVE-2026-45447 High CVSS 8.8 libcrypto3 fixed in 3.5.7-r0 CVE-2026-87636 High CVSS 8.8 libxslt fixed in 1.1.43-r4 CVE-2026-115506 High CVSS 8.7 libexpat fixed in 2.10.0-r0 OS alpine 3.23.4 · fixable: 1 critical, 41 high · scanned 2026-11-11 as `docker.io/nginxinc/nginx-unprivileged:1.29-alpine`
Deployment	loki-read	loki	docker.io/grafana/loki:3.6.11 Moderate 0 critical · 42 high Top 8 of 77 CVEs CVE-2026-46595 High CVSS 10.0 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39821 High CVSS 9.6 golang.org/x/net fixed in 0.55.0 CVE-2026-39830 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39831 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39832 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-42508 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39828 High CVSS 8.8 golang.org/x/crypto fixed in 0.52.0 GHSA-hrxh-6v49-42gf High CVSS 8.8 google.golang.org/grpc fixed in 1.82.1 OS debian 13.4 · fixable: 0 critical, 42 high · scanned 2026-11-11 as `docker.io/grafana/loki:3.6.11`
StatefulSet	loki-backend	loki	docker.io/grafana/loki:3.6.11 Moderate 0 critical · 42 high Top 8 of 77 CVEs CVE-2026-46595 High CVSS 10.0 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39821 High CVSS 9.6 golang.org/x/net fixed in 0.55.0 CVE-2026-39830 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39831 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39832 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-42508 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39828 High CVSS 8.8 golang.org/x/crypto fixed in 0.52.0 GHSA-hrxh-6v49-42gf High CVSS 8.8 google.golang.org/grpc fixed in 1.82.1 OS debian 13.4 · fixable: 0 critical, 42 high · scanned 2026-11-11 as `docker.io/grafana/loki:3.6.11`
StatefulSet	loki-backend	loki-sc-rules	docker.io/kiwigrid/k8s-sidecar:2.5.0 High Likely 1 2 critical · 34 high Top 8 of 91 CVEs CVE-2025-15467 High CVSS 9.8 Likely libcrypto3 fixed in 3.5.5-r0 CVE-2026-31789 Critical CVSS 9.8 libcrypto3 fixed in 3.5.6-r0 GHSA-6q48-6c7w-9gw2 Critical CVSS 9.1 certifi fixed in 2026.10.18 CVE-2026-44432 High CVSS 8.9 urllib3 fixed in 2.7.0 CVE-2026-97689 High CVSS 8.9 urllib3 fixed in 2.8.0 CVE-2026-45447 High CVSS 8.8 libcrypto3 fixed in 3.5.7-r0 CVE-2026-23949 High CVSS 8.6 jaraco.context fixed in 6.1.0 CVE-2026-49272 High CVSS 8.5 oauthlib fixed in 4.0.1 OS alpine 3.22.2 · fixable: 2 critical, 34 high · scanned 2026-11-11 as `docker.io/kiwigrid/k8s-sidecar:2.5.0`
StatefulSet	loki-chunks-cache	exporter	prom/memcached-exporter:v0.15.4 Elevated 1 critical · 42 high Top 8 of 83 CVEs CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3 CVE-2026-46595 High CVSS 10.0 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39821 High CVSS 9.6 golang.org/x/net fixed in 0.55.0 CVE-2026-39830 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39831 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39832 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-42508 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39828 High CVSS 8.8 golang.org/x/crypto fixed in 0.52.0 fixable: 1 critical, 42 high · scanned 2026-11-11 as `docker.io/prom/memcached-exporter:v0.15.4`
StatefulSet	loki-chunks-cache	memcached	memcached:1.6.39-alpine High Likely 1 1 critical · 12 high Top 8 of 51 CVEs CVE-2025-15467 High CVSS 9.8 Likely libcrypto3 fixed in 3.5.5-r0 CVE-2026-31789 Critical CVSS 9.8 libcrypto3 fixed in 3.5.6-r0 CVE-2026-45447 High CVSS 8.8 libcrypto3 fixed in 3.5.7-r0 CVE-2026-85091 High CVSS 8.3 zlib fixed in 1.3.2-r1 CVE-2026-107891 High CVSS 8.1 musl fixed in 1.2.5-r24 CVE-2026-28387 High CVSS 8.1 libcrypto3 fixed in 3.5.6-r0 CVE-2026-40200 High CVSS 8.1 musl fixed in 1.2.5-r23 CVE-2026-22184 High CVSS 7.8 zlib fixed in 1.3.2-r0 OS alpine 3.23.0 · fixable: 1 critical, 12 high · scanned 2026-11-11 as `docker.io/library/memcached:1.6.39-alpine`
StatefulSet	loki-results-cache	exporter	prom/memcached-exporter:v0.15.4 Elevated 1 critical · 42 high Top 8 of 83 CVEs CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3 CVE-2026-46595 High CVSS 10.0 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39821 High CVSS 9.6 golang.org/x/net fixed in 0.55.0 CVE-2026-39830 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39831 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39832 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-42508 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39828 High CVSS 8.8 golang.org/x/crypto fixed in 0.52.0 fixable: 1 critical, 42 high · scanned 2026-11-11 as `docker.io/prom/memcached-exporter:v0.15.4`
StatefulSet	loki-results-cache	memcached	memcached:1.6.39-alpine High Likely 1 1 critical · 12 high Top 8 of 51 CVEs CVE-2025-15467 High CVSS 9.8 Likely libcrypto3 fixed in 3.5.5-r0 CVE-2026-31789 Critical CVSS 9.8 libcrypto3 fixed in 3.5.6-r0 CVE-2026-45447 High CVSS 8.8 libcrypto3 fixed in 3.5.7-r0 CVE-2026-85091 High CVSS 8.3 zlib fixed in 1.3.2-r1 CVE-2026-107891 High CVSS 8.1 musl fixed in 1.2.5-r24 CVE-2026-28387 High CVSS 8.1 libcrypto3 fixed in 3.5.6-r0 CVE-2026-40200 High CVSS 8.1 musl fixed in 1.2.5-r23 CVE-2026-22184 High CVSS 7.8 zlib fixed in 1.3.2-r0 OS alpine 3.23.0 · fixable: 1 critical, 12 high · scanned 2026-11-11 as `docker.io/library/memcached:1.6.39-alpine`
StatefulSet	loki-write	loki	docker.io/grafana/loki:3.6.11 Moderate 0 critical · 42 high Top 8 of 77 CVEs CVE-2026-46595 High CVSS 10.0 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39821 High CVSS 9.6 golang.org/x/net fixed in 0.55.0 CVE-2026-39830 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39831 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39832 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-42508 High CVSS 9.1 golang.org/x/crypto fixed in 0.52.0 CVE-2026-39828 High CVSS 8.8 golang.org/x/crypto fixed in 0.52.0 GHSA-hrxh-6v49-42gf High CVSS 8.8 google.golang.org/grpc fixed in 1.82.1 OS debian 13.4 · fixable: 0 critical, 42 high · scanned 2026-11-11 as `docker.io/grafana/loki:3.6.11`

`loki-rollout-operator`

Namespace: default | Automount:

Permissions (4)

Role	Resource	Verbs	Risk	Tags
ClusterRole `loki-rollout-operator-webhook-clusterrole`	admissionregistration.k8s.io/mutatingwebhookconfigurations	list · patch · watch	Medium	InformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole `loki-rollout-operator-webhook-clusterrole`	admissionregistration.k8s.io/validatingwebhookconfigurations	list · patch · watch	Medium	InformationDisclosure Reconnaissance WebhookReconnaissance
Role `loki-rollout-operator-webhook-role`	core/secrets	create	Low
Role `loki-rollout-operator-webhook-role`	core/secrets (restricted to: certificate)	get · update	Low	ResourceNameRestricted

Potential Abuse (3)

The following security risks were found based on the above permissions:

Workloads (1)

Kind	Name	Container	Image
Deployment	loki-rollout-operator	rollout-operator	docker.io/grafana/rollout-operator:v0.40.0 Moderate 0 critical · 5 high Top 8 of 18 CVEs CVE-2026-78661 High CVSS 7.5 golang.org/x/net fixed in 0.62.0 CVE-2026-78667 High CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-78669 High CVSS 7.5 golang.org/x/net fixed in 0.60.0 CVE-2026-97031 High CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-111943 High CVSS 6.8 stdlib fixed in 1.26.10, 1.27.3 CVE-2026-78663 Medium CVSS 9.1 golang.org/x/net fixed in 0.60.0 CVE-2026-56866 Medium CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-78659 Medium CVSS 7.5 golang.org/x/net fixed in 0.60.0 OS debian 13.6 · fixable: 0 critical, 5 high · scanned 2026-11-11 as `docker.io/grafana/rollout-operator:v0.40.0`

`loki-canary`

Namespace: default | Automount:

Permissions (0)

No explicit RBAC bindings.

Workloads (1)

Kind	Name	Container	Image
DaemonSet	loki-canary	loki-canary	docker.io/grafana/loki-canary:3.6.18 Moderate 0 critical · 2 high Top 6 of 6 CVEs CVE-2026-78661 High CVSS 7.5 golang.org/x/net fixed in 0.62.0 CVE-2026-111943 High CVSS 6.8 stdlib fixed in 1.26.10, 1.27.3 CVE-2026-97045 Medium CVSS 6.1 golang.org/x/net fixed in 0.62.0 CVE-2026-97054 Unknown stdlib fixed in 1.26.11, 1.27.4 GO-2026-5932 Unknown golang.org/x/crypto fixed in 0.58.1-0.20261009181718-2f1f834330b2 DSA-6572-1 Unknown ca-certificates fixed in 20250419+deb13u1 OS debian 13.7 · fixable: 0 critical, 2 high · scanned 2026-11-11 as `docker.io/grafana/loki-canary:3.6.18`

`minio-sa`

Namespace: default | Automount:

Permissions (0)

No explicit RBAC bindings.

Workloads (3)

Kind	Name	Container	Image
Job	loki-minio-post-job	minio-make-bucket	docker.io/pgsty/mc:RELEASE.2026-09-13T00-00-00Z Moderate 0 critical · 8 high Top 8 of 50 CVEs CVE-2026-86145 High CVSS 8.2 pcre2 fixed in 10.40-7.el9_8 CVE-2026-89161 High CVSS 7.8 pcre2 fixed in 10.40-7.el9_8 CVE-2026-103111 High CVSS 7.6 pcre2 fixed in 10.40-7.el9_8 CVE-2026-78661 High CVSS 7.5 golang.org/x/net fixed in 0.62.0 CVE-2026-78667 High CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-78669 High CVSS 7.5 golang.org/x/net fixed in 0.60.0 CVE-2026-97031 High CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-111943 High CVSS 6.8 stdlib fixed in 1.26.10, 1.27.3 OS redhat 9.8 · fixable: 0 critical, 8 high · scanned 2026-11-11 as `docker.io/pgsty/mc:RELEASE.2026-09-13T00-00-00Z`
Job	loki-minio-post-job	minio-make-user	docker.io/pgsty/mc:RELEASE.2026-09-13T00-00-00Z Moderate 0 critical · 8 high Top 8 of 50 CVEs CVE-2026-86145 High CVSS 8.2 pcre2 fixed in 10.40-7.el9_8 CVE-2026-89161 High CVSS 7.8 pcre2 fixed in 10.40-7.el9_8 CVE-2026-103111 High CVSS 7.6 pcre2 fixed in 10.40-7.el9_8 CVE-2026-78661 High CVSS 7.5 golang.org/x/net fixed in 0.62.0 CVE-2026-78667 High CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-78669 High CVSS 7.5 golang.org/x/net fixed in 0.60.0 CVE-2026-97031 High CVSS 7.5 stdlib fixed in 1.26.9, 1.27.2 CVE-2026-111943 High CVSS 6.8 stdlib fixed in 1.26.10, 1.27.3 OS redhat 9.8 · fixable: 0 critical, 8 high · scanned 2026-11-11 as `docker.io/pgsty/mc:RELEASE.2026-09-13T00-00-00Z`
StatefulSet	loki-minio	minio	docker.io/pgsty/silo:RELEASE.2026-09-03T13-18-01Z Elevated 3 critical · 17 high Top 8 of 65 CVEs CVE-2026-77411 Critical CVSS 9.5 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-77405 Critical CVSS 9.4 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-77408 Critical CVSS 9.1 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-77403 High CVSS 8.9 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-77410 High CVSS 8.9 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-77412 High CVSS 8.9 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-79921 High CVSS 8.9 github.com/rabbitmq/amqp091-go fixed in 1.13.0 CVE-2026-77404 High CVSS 8.7 github.com/rabbitmq/amqp091-go fixed in 1.13.0 OS redhat 9.8 · fixable: 3 critical, 16 high · scanned 2026-11-11 as `docker.io/pgsty/silo:RELEASE.2026-09-03T13-18-01Z`

loki

Riskiest combinations

Description

Overview

Identities

loki-grafana-agent-operator

Permissions (25)

Potential Abuse (20)

Workloads (1)

grafana-agent-test-sa

Permissions (7)

Potential Abuse (2)

Workloads (0)

loki

Permissions (2)

Potential Abuse (5)

Workloads (9)

loki-rollout-operator

Permissions (4)

Potential Abuse (3)

Workloads (1)

loki-canary

Permissions (0)

Workloads (1)

minio-sa

Permissions (0)

Workloads (3)

`loki-grafana-agent-operator`

`grafana-agent-test-sa`

`loki`

`loki-rollout-operator`

`loki-canary`

`minio-sa`