2 Service Accounts
1 Workloads
17 Bindings
7 Critical
8 High
1 Medium
1 Low
Description
Event based autoscaler for Azure Functions deployments on Kubernetes
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
keda-operator | default | ❌ | — | 16 | 2 | Critical |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 keda-operator
Namespace: default | Automount: ❌
🔑 Permissions (16)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole keda-operator | core/configmaps | * | Critical | ClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more) |
ClusterRole keda-operator | apps/deployments | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole keda-operator | core/endpoints | * | Critical | ClusterWideAccess DenialOfService ManInTheMiddle NetworkManipulation Tampering (+2 more) |
ClusterRole keda-operator | batch/jobs | * | Critical | ClusterWideAccess PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+1 more) |
ClusterRole keda-operator | core/pods | * | Critical | ClusterWideAccess LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation (+3 more) |
ClusterRole keda-operator | core/secrets | * | Critical | ClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more) |
ClusterRole keda-operator | core/services | * | Critical | ClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more) |
ClusterRole keda-operator | keda.k8s.io/* | * | High | ClusterWideAccess |
ClusterRole keda-operator | apps/deployments/finalizers | * | High | ClusterWideAccess |
ClusterRole keda-operator | core/external | * | High | ClusterWideAccess |
ClusterRole keda-operator | autoscaling/horizontalpodautoscalers | * | High | ClusterWideAccess |
ClusterRole keda-operator | core/namespaces | * | High | ClusterStructure ClusterWideAccess DenialOfService InformationDisclosure NamespaceLifecycle (+3 more) |
ClusterRole keda-operator | apps/replicasets | * | High | ClusterWideAccess |
ClusterRole keda-operator | core/services/finalizers | * | High | ClusterWideAccess |
ClusterRole keda-operator | core/events | * | Medium | ClusterWideAccess InformationDisclosure OperationalData Reconnaissance |
ClusterRole keda-operator | monitoring.coreos.com/servicemonitors | create · get | Low |
⚠️ Potential Abuse (25)
The following security risks were found based on the above permissions:
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps cluster-wide
- Modify ConfigMaps in a namespace
- Delete namespaces
- Manage Deployments cluster-wide (potential for privileged pod execution)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage Jobs cluster-wide (one-off privileged execution)
- Manage Jobs in a namespace (one-off privileged execution)
- Read events cluster-wide
- Manage Endpoints or EndpointSlices cluster-wide
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services cluster-wide
- Manage Services in a namespace
- List Namespaces (Cluster Reconnaissance)
📦 Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | keda-operator | keda-operator | docker.io/kedacore/keda:1.1.0 |
| Deployment | keda-operator | keda-operator-metrics-apiserver | docker.io/kedacore/keda-metrics-adapter:1.1.0 |