21 Service Accounts
19 Workloads
253 Bindings
16 Critical
145 High
6 Medium
86 Low
Description
Kasten’s K10 Data Management Platform
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
aggregatedapis-svc | default | — | 42 | 1 | Critical | |
auth-svc | default | — | 17 | 1 | Critical | |
catalog-svc | default | — | 15 | 2 | Critical | |
crypto-svc | default | — | 24 | 4 | Critical | |
frontend-svc | default | — | 13 | 1 | Critical | |
gateway | default | — | 13 | 1 | Critical | |
jobs-svc | default | — | 14 | 1 | Critical | |
k10-kube-state-metrics | default | — | 28 | 1 | Critical | |
logging-svc | default | — | 13 | 1 | Critical | |
metering-svc | default | — | 18 | 1 | Critical | |
state-svc | default | — | 18 | 2 | Critical | |
prometheus-server | default | — | 12 | 2 | Medium | |
controllermanager-svc | default | — | 0 | 1 | — | |
dashboardbff-svc | default | — | 0 | 2 | — | |
executor-svc | default | — | 0 | 1 | — | |
k10-alertmanager | default | — | 0 | 1 | — | |
k10-prometheus-node-exporter | default | — | 0 | 1 | — | |
k10-prometheus-pushgateway | default | — | 0 | 1 | — | |
kanister-svc | default | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
aggregatedapis-svc
Namespace: default | Automount:
Permissions (42)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole kasten-aggregatedapis-svc | * | list · watch | Critical | ClusterStructure ClusterWideAccess ClusterWideSecretAccess ConfigMapAccess CredentialAccess (+12 more) |
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-aggregatedapis-svc | core/secrets | * | Critical | ClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-aggregatedapis-svc | authorization.k8s.io/subjectaccessreviews | create · update | Medium | InformationDisclosure RBACQuery |
ClusterRole kasten-aggregatedapis-svc | apiregistration.k8s.io/apiservices | create · update | Low | |
ClusterRole kasten-aggregatedapis-svc | core/configmaps | get · list | Low | |
ClusterRole kasten-aggregatedapis-svc | apiextensions.k8s.io/customresourcedefinitions | list | Low | |
ClusterRole kasten-aggregatedapis-svc | apps.openshift.io/deploymentconfigs | get · list | Low | |
ClusterRole kasten-aggregatedapis-svc | apps/deployments | get · list | Low | |
ClusterRole kasten-aggregatedapis-svc | networking.k8s.io/ingresses | list | Low | |
ClusterRole kasten-aggregatedapis-svc | core/namespaces | get · list | Low | |
Role kasten-default | core/namespaces | get | Low | |
ClusterRole kasten-aggregatedapis-svc | core/nodes | list | Low | |
ClusterRole kasten-aggregatedapis-svc | core/persistentvolumeclaims | get · list | Low | |
ClusterRole kasten-aggregatedapis-svc | core/persistentvolumes | create · get · list · update | Low | |
ClusterRole kasten-aggregatedapis-svc | core/pods | list | Low | |
ClusterRole kasten-aggregatedapis-svc | networking.k8s.aws/policyendpoints | list | Low | |
ClusterRole kasten-aggregatedapis-svc | apps/replicasets | list | Low | |
ClusterRole kasten-aggregatedapis-svc | core/replicationcontrollers | list | Low | |
ClusterRole kasten-aggregatedapis-svc | rbac.authorization.k8s.io/rolebindings | create · update | Low | |
ClusterRole kasten-aggregatedapis-svc | vpcresources.k8s.aws/securitygrouppolicies | list | Low | |
ClusterRole kasten-aggregatedapis-svc | authorization.k8s.io/selfsubjectaccessreviews | create · update | Low | |
ClusterRole kasten-aggregatedapis-svc | core/services | list | Low | |
ClusterRole kasten-aggregatedapis-svc | apps/statefulsets | get · list | Low | |
ClusterRole kasten-aggregatedapis-svc | storage.k8s.io/storageclasses | get | Low | |
ClusterRole kasten-aggregatedapis-svc | kubevirt.io/virtualmachineinstances | get | Low | |
ClusterRole kasten-aggregatedapis-svc | kubevirt.io/virtualmachines | get · list | Low | |
ClusterRole kasten-aggregatedapis-svc | snapshot.storage.k8s.io/volumesnapshotclasses | create · get · update | Low | |
ClusterRole kasten-aggregatedapis-svc | snapshot.storage.k8s.io/volumesnapshotcontents | create · get · update | Low | |
ClusterRole kasten-aggregatedapis-svc | snapshot.storage.k8s.io/volumesnapshots | list | Low |
Potential Abuse (52)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create SubjectAccessReviews (check arbitrary permissions)
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Read events cluster-wide
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Read RBAC configuration cluster-wide
- Manage Leases in kube-system or kube-node-lease namespace
- List Namespaces (Cluster Reconnaissance)
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Read All ResourceQuotas (Cluster-wide Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSINode Objects (Node & Storage Reconnaissance)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | aggregatedapis-svc | aggregatedapis-svc | gcr.io/kasten-images/aggregatedapis:9.0.3 |
k10-kube-state-metrics
Namespace: default | Automount:
Permissions (28)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole k10-kube-state-metrics | core/secrets | list · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole k10-kube-state-metrics | core/configmaps | list · watch | High | ConfigMapAccess DataExposure InformationDisclosure |
ClusterRole k10-kube-state-metrics | admissionregistration.k8s.io/mutatingwebhookconfigurations | list · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole k10-kube-state-metrics | core/resourcequotas | list · watch | Medium | InformationDisclosure QuotaTampering Reconnaissance ResourceConfiguration |
ClusterRole k10-kube-state-metrics | admissionregistration.k8s.io/validatingwebhookconfigurations | list · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole k10-kube-state-metrics | certificates.k8s.io/certificatesigningrequests | list · watch | Low | |
ClusterRole k10-kube-state-metrics | batch/cronjobs | list · watch | Low | |
ClusterRole k10-kube-state-metrics | apps/daemonsets | list · watch | Low | |
ClusterRole k10-kube-state-metrics | apps/deployments | list · watch | Low | |
ClusterRole k10-kube-state-metrics | discovery.k8s.io/endpointslices | list · watch | Low | |
ClusterRole k10-kube-state-metrics | autoscaling/horizontalpodautoscalers | list · watch | Low | |
ClusterRole k10-kube-state-metrics | networking.k8s.io/ingresses | list · watch | Low | |
ClusterRole k10-kube-state-metrics | batch/jobs | list · watch | Low | |
ClusterRole k10-kube-state-metrics | coordination.k8s.io/leases | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/limitranges | list · watch | Low | InformationDisclosure Reconnaissance ResourceConfiguration |
ClusterRole k10-kube-state-metrics | core/namespaces | list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole k10-kube-state-metrics | networking.k8s.io/networkpolicies | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/nodes | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/persistentvolumeclaims | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/persistentvolumes | list · watch | Low | |
ClusterRole k10-kube-state-metrics | policy/poddisruptionbudgets | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/pods | list · watch | Low | |
ClusterRole k10-kube-state-metrics | apps/replicasets | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/replicationcontrollers | list · watch | Low | |
ClusterRole k10-kube-state-metrics | core/services | list · watch | Low | |
ClusterRole k10-kube-state-metrics | apps/statefulsets | list · watch | Low | |
ClusterRole k10-kube-state-metrics | storage.k8s.io/storageclasses | list · watch | Low | |
ClusterRole k10-kube-state-metrics | storage.k8s.io/volumeattachments | list · watch | Low |
Potential Abuse (11)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- List Namespaces (Cluster Reconnaissance)
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Read All ResourceQuotas (Cluster-wide Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | k10-kube-state-metrics | kube-state-metrics | registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0 |
crypto-svc
Namespace: default | Automount:
Permissions (24)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-crypto-svc | core/configmaps | delete · list | Low | |
ClusterRole kasten-crypto-svc | core/namespaces | list | Low | |
Role kasten-default | core/namespaces | get | Low | |
ClusterRole kasten-crypto-svc | networking.k8s.io/networkpolicies | delete · list | Low | |
ClusterRole kasten-crypto-svc | core/nodes | get | Low | |
ClusterRole kasten-crypto-svc | core/persistentvolumes | delete · list · patch | Low | |
ClusterRole kasten-crypto-svc | core/pods | delete · list | Low | |
ClusterRole kasten-crypto-svc | core/secrets | delete · list | Low | |
ClusterRole kasten-crypto-svc | core/services | delete · list | Low | |
ClusterRole kasten-crypto-svc | snapshot.storage.k8s.io/volumesnapshotcontents | delete · list | Low | |
ClusterRole kasten-crypto-svc | snapshot.storage.k8s.io/volumesnapshots | get · list | Low |
Potential Abuse (41)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (4)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | crypto-svc | bloblifecyclemanager-svc | gcr.io/kasten-images/bloblifecyclemanager:9.0.3 |
| Deployment | crypto-svc | crypto-svc | gcr.io/kasten-images/crypto:9.0.3 |
| Deployment | crypto-svc | garbagecollector-svc | gcr.io/kasten-images/garbagecollector:9.0.3 |
| Deployment | crypto-svc | repositories-svc | gcr.io/kasten-images/repositories:9.0.3 |
metering-svc
Namespace: default | Automount:
Permissions (18)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-metering-svc | core/namespaces | list | Low | |
Role kasten-default | core/namespaces | get | Low | |
ClusterRole kasten-metering-svc | core/nodes | list | Low | |
ClusterRole kasten-metering-svc | core/persistentvolumeclaims | list · watch | Low | |
ClusterRole kasten-metering-svc | storage.k8s.io/storageclasses | list | Low |
Potential Abuse (41)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | metering-svc | metering-svc | gcr.io/kasten-images/metering:9.0.3 |
state-svc
Namespace: default | Automount:
Permissions (18)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-state-svc | apps.openshift.io/deploymentconfigs | list · watch | Low | |
ClusterRole kasten-state-svc | apps/deployments | list · watch | Low | |
ClusterRole kasten-state-svc | core/namespaces | list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole kasten-state-svc | apps/statefulsets | list · watch | Low | |
ClusterRole kasten-state-svc | kubevirt.io/virtualmachines | list · watch | Low |
Potential Abuse (42)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- List Namespaces (Cluster Reconnaissance)
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | state-svc | events-svc | gcr.io/kasten-images/events:9.0.3 |
| Deployment | state-svc | state-svc | gcr.io/kasten-images/state:9.0.3 |
auth-svc
Namespace: default | Automount:
Permissions (17)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-auth-svc | core/secrets | create · get · list · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-auth-svc | authentication.k8s.io/tokenreviews | create · update | Medium | CredentialAccess InformationDisclosure RBACQuery |
Role kasten-default | core/namespaces | get | Low | |
ClusterRole kasten-auth-svc | core/serviceaccounts/token | create · update | Low |
Potential Abuse (43)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create TokenReviews (validate arbitrary tokens)
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | auth-svc | auth-svc | gcr.io/kasten-images/auth:9.0.3 |
catalog-svc
Namespace: default | Automount:
Permissions (15)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-catalog-svc | core/namespaces | list | Low | |
Role kasten-default | core/namespaces | get | Low |
Potential Abuse (41)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | catalog-svc | catalog-svc | gcr.io/kasten-images/catalog:9.0.3 |
| Deployment | catalog-svc | kanister-sidecar | gcr.io/kasten-images/kanister-tools:9.0.3 |
jobs-svc
Namespace: default | Automount:
Permissions (14)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
Role kasten-default | core/namespaces | get | Low |
Potential Abuse (41)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | jobs-svc | jobs-svc | gcr.io/kasten-images/jobs:9.0.3 |
frontend-svc
Namespace: default | Automount:
Permissions (13)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
Potential Abuse (40)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | frontend-svc | frontend-svc | gcr.io/kasten-images/frontend:9.0.3 |
gateway
Namespace: default | Automount:
Permissions (13)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
Potential Abuse (40)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | gateway | gateway | gcr.io/kasten-images/gateway:9.0.3 |
logging-svc
Namespace: default | Automount:
Permissions (13)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kasten-admin | * | * | Critical | AvailabilityImpact BindingToPrivilegedRole CodeExecution ConfigMapAccess ControlPlaneDisruption (+40 more) |
ClusterRole kasten-svc-admin | actions.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | apps.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | auth.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | config.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | cr.kanister.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | datamover.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dist.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | dr.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | reporting.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | repositories.kio.kasten.io/* | * | High | ClusterWideAccess |
ClusterRole kasten-svc-admin | vault.kio.kasten.io/* | * | High | ClusterWideAccess |
Potential Abuse (40)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Manage ephemeral containers in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets in a namespace
- Manage CronJobs in a namespace (scheduled privileged execution, persistence)
- Manage Jobs in a namespace (one-off privileged execution)
- Create ServiceAccount Tokens
- Create LocalSubjectAccessReviews (check permissions in a namespace)
- Evict Pods in a namespace
- Wildcard permission on all resources in a namespace (Namespace Admin)
- Manage ArgoCD Applications (argoproj.io)
- Manage ServiceAccounts in a namespace
- Manage NetworkPolicies in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Create/Update ControllerRevisions (Potential Tampering)
- Create SelfSubjectRulesReviews (Discover Own Permissions)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
- Update PodDisruptionBudget Status (Namespace Tampering/DoS)
- Update Deployment Scale (Resource Abuse/DoS)
- Update StatefulSet Scale (Resource Abuse/DoS)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | logging-svc | logging-svc | gcr.io/kasten-images/logging:9.0.3 |
prometheus-server
Namespace: default | Automount:
Permissions (12)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role k10-prometheus-server | core/configmaps | get · list · watch | Medium | ConfigMapAccess DataExposure InformationDisclosure |
Role k10-prometheus-server | core/endpoints | get · list · watch | Low | |
Role k10-prometheus-server | core/ingresses | get · list · watch | Low | |
Role k10-prometheus-server | extensions/ingresses | get · list · watch | Low | |
Role k10-prometheus-server | networking.k8s.io/ingresses | get · list · watch | Low | |
Role k10-prometheus-server | extensions/ingresses/status | get · list · watch | Low | |
Role k10-prometheus-server | networking.k8s.io/ingresses/status | get · list · watch | Low | |
Role k10-prometheus-server | core/nodes | get · list · watch | Low | |
Role k10-prometheus-server | core/nodes/metrics | get · list · watch | Low | |
Role k10-prometheus-server | core/nodes/proxy | get · list · watch | Low | |
Role k10-prometheus-server | core/pods | get · list · watch | Low | |
Role k10-prometheus-server | core/services | get · list · watch | Low |
Potential Abuse (2)
The following security risks were found based on the above permissions:
Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | prometheus-server | prometheus-server | gcr.io/kasten-images/prometheus:9.0.3 |
| Deployment | prometheus-server | prometheus-server-configmap-reload | gcr.io/kasten-images/configmap-reload:9.0.3 |
controllermanager-svc
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | controllermanager-svc | controllermanager-svc | gcr.io/kasten-images/controllermanager:9.0.3 |
dashboardbff-svc
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | dashboardbff-svc | dashboardbff-svc | gcr.io/kasten-images/dashboardbff:9.0.3 |
| Deployment | dashboardbff-svc | vbrintegrationapi-svc | gcr.io/kasten-images/vbrintegrationapi:9.0.3 |
executor-svc
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | executor-svc | executor-svc | gcr.io/kasten-images/executor:9.0.3 |
k10-alertmanager
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | k10-alertmanager | alertmanager | quay.io/prometheus/alertmanager:v0.32.1 |
k10-prometheus-node-exporter
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| DaemonSet | k10-prometheus-node-exporter | node-exporter | quay.io/prometheus/node-exporter:v1.11.1 |
k10-prometheus-pushgateway
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | k10-prometheus-pushgateway | pushgateway | quay.io/prometheus/pushgateway:v1.11.2 |
kanister-svc
Namespace: default | Automount:
Permissions (0)
No explicit RBAC bindings.
Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kanister-svc | kanister-svc | gcr.io/kasten-images/kanister:9.0.3 |