secret-operator
v0.2.0
2 Service Accounts
2 Workloads
13 Bindings
2 Critical
1 Medium
10 Low
Description
The Kubedoop Secret Operator
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
secret-operator | default | ❌ | — | 12 | 4 | Critical |
secret-operator-ds-check | default | ❌ | — | 1 | 1 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 secret-operator
Namespace: default | Automount: ❌
🔑 Permissions (12)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole secret-operator-daemonset | core/pods | create · get · list · patch · update · watch | Critical | LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+1 more) |
ClusterRole secret-operator-daemonset | core/secrets | create · get · list · patch · update · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole secret-operator-daemonset | core/events | create · get · list · patch · update · watch | Medium | InformationDisclosure OperationalData Reconnaissance |
ClusterRole secret-operator-daemonset | storage.k8s.io/csidrivers | get · list · watch | Low | |
ClusterRole secret-operator-daemonset | listeners.kubedoop.dev/listeners | get · list · watch | Low | |
ClusterRole secret-operator-daemonset | core/nodes | get · list · watch | Low | |
ClusterRole secret-operator-daemonset | core/persistentvolumeclaims | get · list · watch | Low | |
ClusterRole secret-operator-daemonset | core/persistentvolumes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole secret-operator-daemonset | secrets.kubedoop.dev/secretclasses | create · delete · get · list · patch · update · watch | Low | |
ClusterRole secret-operator-daemonset | secrets.kubedoop.dev/secretclasses/finalizers | update | Low | |
ClusterRole secret-operator-daemonset | secrets.kubedoop.dev/secretclasses/status | get · patch · update | Low | |
ClusterRole secret-operator-daemonset | storage.k8s.io/storageclasses | get · list · watch | Low |
⚠️ Potential Abuse (8)
The following security risks were found based on the above permissions:
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Read events cluster-wide
📦 Workloads (4)
| Kind | Name | Container | Image |
|---|---|---|---|
| DaemonSet | secret-operator-daemonset | csi-provisioner | registry.k8s.io/sig-storage/csi-provisioner:v5.1.0 |
| DaemonSet | secret-operator-daemonset | liveness-probe | registry.k8s.io/sig-storage/livenessprobe:v2.14.0 |
| DaemonSet | secret-operator-daemonset | node-driver-registrar | registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.12.0 |
| DaemonSet | secret-operator-daemonset | secret-operator | quay.io/zncdatadev/secret-csi-driver:0.2.0 |
🤖 secret-operator-ds-check
Namespace: default | Automount: ❌
🔑 Permissions (1)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role secret-operator-ds-check | apps/daemonsets | get · list · watch | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | secret-operator-ds-check | kubectl | quay.io/zncdatadev/tools:1.0.0-kubedoop0.0.0-dev |