cost-analyzer

Description

A Helm chart that sets up Kubecost, Prometheus, and Grafana to monitor cloud costs.

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 cost-analyzer-prometheus-kube-state-metrics

Namespace: default  |  Automount: ❌

🔑 Permissions (24)

⚠️ Potential Abuse (9)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• List Namespaces (Cluster Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (1)

🤖 cost-analyzer-prometheus-server

Namespace: default  |  Automount: ❌

🔑 Permissions (9)

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Node proxy GET RCE via WebSocket

📦 Workloads (2)

🤖 cost-analyzer

Namespace: default  |  Automount: ❌

🔑 Permissions (26)

⚠️ Potential Abuse (8)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Read events cluster-wide
• List Namespaces (Cluster Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (3)

🤖 cost-analyzer-grafana

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (3)

🤖 cost-analyzer-prometheus-alertmanager

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (2)

🤖 cost-analyzer-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 cost-analyzer-prometheus-pushgateway

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)