ingress-nginx :: RBAC ATLAS

Description

Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer

https://github.com/kubernetes/ingress-nginx

Overview

Identity	Namespace	Automount	Secrets	Permissions	Workloads	Risk
`ingress-nginx`	default	✅	—	25	1	Critical
`ingress-nginx-admission`	default	✅	—	2	2	Low

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 `ingress-nginx`

Namespace: default | Automount: ✅

🔑 Permissions (25)

Role	Resource	Verbs	Risk	Tags
Role `ingress-nginx`	core/secrets	get · list · watch	Critical	CredentialAccess DataExposure InformationDisclosure SecretAccess
Role `ingress-nginx`	core/configmaps	get · list · watch	Medium	ConfigMapAccess DataExposure InformationDisclosure
ClusterRole `ingress-nginx`	core/configmaps	list · watch	Low
ClusterRole `ingress-nginx`	core/endpoints	list · watch	Low
Role `ingress-nginx`	core/endpoints	get · list · watch	Low
ClusterRole `ingress-nginx`	discovery.k8s.io/endpointslices	get · list · watch	Low
Role `ingress-nginx`	discovery.k8s.io/endpointslices	get · list · watch	Low
ClusterRole `ingress-nginx`	core/events	create · patch	Low
Role `ingress-nginx`	core/events	create · patch	Low
ClusterRole `ingress-nginx`	networking.k8s.io/ingressclasses	get · list · watch	Low
Role `ingress-nginx`	networking.k8s.io/ingressclasses	get · list · watch	Low
ClusterRole `ingress-nginx`	networking.k8s.io/ingresses	get · list · watch	Low
Role `ingress-nginx`	networking.k8s.io/ingresses	get · list · watch	Low
ClusterRole `ingress-nginx`	networking.k8s.io/ingresses/status	update	Low
Role `ingress-nginx`	networking.k8s.io/ingresses/status	update	Low
ClusterRole `ingress-nginx`	coordination.k8s.io/leases	list · watch	Low
Role `ingress-nginx`	coordination.k8s.io/leases	create · get · update	Low
ClusterRole `ingress-nginx`	core/namespaces	list · watch	Low	ClusterStructure InformationDisclosure Reconnaissance
Role `ingress-nginx`	core/namespaces	get	Low
ClusterRole `ingress-nginx`	core/nodes	get · list · watch	Low
ClusterRole `ingress-nginx`	core/pods	list · watch	Low
Role `ingress-nginx`	core/pods	get · list · watch	Low
ClusterRole `ingress-nginx`	core/secrets	list · watch	Low
ClusterRole `ingress-nginx`	core/services	get · list · watch	Low
Role `ingress-nginx`	core/services	get · list · watch	Low

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

📦 Workloads (1)

Kind	Name	Container	Image
Deployment	ingress-nginx-controller	controller	registry.k8s.io/ingress-nginx/controller:v1.12.3@sha256:ac444cd9515af325ba577b596fe4f27a34be1aa330538e8b317ad9d6c8fb94ee

🤖 `ingress-nginx-admission`

Namespace: default | Automount: ✅

🔑 Permissions (2)

Role	Resource	Verbs	Risk	Tags
Role `ingress-nginx-admission`	core/secrets	create · get	Low
ClusterRole `ingress-nginx-admission`	admissionregistration.k8s.io/validatingwebhookconfigurations	get · update	Low

⚠️ Potential Abuse (1)