7 Service Accounts
8 Workloads
47 Bindings
4 Critical
3 High
2 Medium
38 Low
Description
Kubernetes Native Policy Management
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
kyverno-admission-controller | default | ❌ | — | 7 | 3 | Critical |
kyverno-background-controller | default | ❌ | — | 5 | 1 | Critical |
kyverno-reports-controller | default | ❌ | — | 5 | 1 | Critical |
kyverno-migrate-resources | default | ❌ | — | 4 | 1 | High |
kyverno-reports-server | default | ❌ | — | 15 | 1 | Medium |
kyverno-cleanup-controller | default | ❌ | — | 11 | 1 | Low |
kyverno-postgresql | default | ❌ | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 kyverno-admission-controller
Namespace: default | Automount: ❌
🔑 Permissions (7)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kyverno:admission-controller | coordination.k8s.io/leases | create · delete · get · patch · update | Critical | ControlPlaneDisruption CriticalNamespace DenialOfService Tampering |
Role kyverno:admission-controller | core/secrets | create · delete · get · list · patch · update · watch | Critical | CredentialAccess DataExposure InformationDisclosure Persistence PotentialPrivilegeEscalation (+2 more) |
Role kyverno:admission-controller | apps/deployments/scale | get · list · patch · update · watch | High | DenialOfService ResourceModification Tampering WorkloadLifecycle |
Role kyverno:admission-controller | core/serviceaccounts | create · delete · get · list · patch · update · watch | Medium | IdentityManagement PotentialPrivilegeEscalation Tampering |
Role kyverno:admission-controller | apps/deployments | get · list · patch · update · watch | Low | |
Role kyverno:admission-controller | core/configmaps (restricted to: kyverno) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
Role kyverno:admission-controller | core/configmaps (restricted to: kyverno-metrics) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
⚠️ Potential Abuse (7)
The following security risks were found based on the above permissions:
- Read secrets in a namespace
- Modify secrets in a namespace
- Read ConfigMaps in a namespace
- Manage ServiceAccounts in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
- Update Deployment Scale (Resource Abuse/DoS)
📦 Workloads (3)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kyverno-admission-controller | kyverno | reg.kyverno.io/kyverno/kyverno:v1.19.1 |
| Job | kyverno-rm-webhooks | kubectl | ghcr.io/kyverno/readiness-checker:v1.19.1 |
| Job | kyverno-scale-to-zero | kubectl | ghcr.io/kyverno/readiness-checker:v1.19.1 |
🤖 kyverno-background-controller
Namespace: default | Automount: ❌
🔑 Permissions (5)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kyverno:background-controller | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role kyverno:background-controller | coordination.k8s.io/leases | create | Low | |
Role kyverno:background-controller | core/configmaps (restricted to: kyverno) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
Role kyverno:background-controller | coordination.k8s.io/leases (restricted to: kyverno-background-controller) | delete · get · patch · update | Low | ResourceNameRestricted |
Role kyverno:background-controller | core/configmaps (restricted to: kyverno-metrics) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
⚠️ Potential Abuse (3)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kyverno-background-controller | controller | reg.kyverno.io/kyverno/background-controller:v1.19.1 |
🤖 kyverno-reports-controller
Namespace: default | Automount: ❌
🔑 Permissions (5)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kyverno:reports-controller | core/secrets | get · list · watch | Critical | CredentialAccess DataExposure InformationDisclosure SecretAccess |
Role kyverno:reports-controller | coordination.k8s.io/leases | create | Low | |
Role kyverno:reports-controller | core/configmaps (restricted to: kyverno) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
Role kyverno:reports-controller | core/configmaps (restricted to: kyverno-metrics) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
Role kyverno:reports-controller | coordination.k8s.io/leases (restricted to: kyverno-reports-controller) | delete · get · patch · update | Low | ResourceNameRestricted |
⚠️ Potential Abuse (3)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kyverno-reports-controller | controller | reg.kyverno.io/kyverno/reports-controller:v1.19.1 |
🤖 kyverno-migrate-resources
Namespace: default | Automount: ❌
🔑 Permissions (4)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole kyverno:migrate-resources | kyverno.io/* | get · list · update | High | ClusterWideAccess |
ClusterRole kyverno:migrate-resources | policies.kyverno.io/* | get · list · update | High | ClusterWideAccess |
ClusterRole kyverno:migrate-resources | apiextensions.k8s.io/customresourcedefinitions | get | Low | |
ClusterRole kyverno:migrate-resources | apiextensions.k8s.io/customresourcedefinitions/status | update | Low |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Job | kyverno-migrate-resources | kyverno-cli | reg.kyverno.io/kyverno/kyverno-cli:v1.19.1 |
🤖 kyverno-reports-server
Namespace: default | Automount: ❌
🔑 Permissions (15)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole kyverno-reports-server | authorization.k8s.io/subjectaccessreviews | create | Medium | InformationDisclosure RBACQuery |
ClusterRole kyverno-reports-server | apiregistration.k8s.io/apiservices | create | Low | |
ClusterRole kyverno-reports-server | reports.kyverno.io/clusterephemeralreports | create · delete · deletecollection · get · list · patch · update · watch | Low | |
ClusterRole kyverno-reports-server | wgpolicyk8s.io/clusterpolicyreports | create · delete · deletecollection · get · list · patch · update · watch | Low | |
ClusterRole kyverno-reports-server | wgpolicyk8s.io/clusterpolicyreports/status | create · delete · deletecollection · get · list · patch · update · watch | Low | |
ClusterRole kyverno-reports-server | reports.kyverno.io/ephemeralreports | create · delete · deletecollection · get · list · patch · update · watch | Low | |
ClusterRole kyverno-reports-server | core/events | create · patch | Low | |
ClusterRole kyverno-reports-server | events.k8s.io/events | create · patch | Low | |
ClusterRole kyverno-reports-server | core/namespaces | get | Low | |
Role kyverno-reports-server | core/pods | get · list | Low | |
ClusterRole kyverno-reports-server | wgpolicyk8s.io/policyreports | create · delete · deletecollection · get · list · patch · update · watch | Low | |
ClusterRole kyverno-reports-server | wgpolicyk8s.io/policyreports/status | create · delete · deletecollection · get · list · patch · update · watch | Low | |
ClusterRole kyverno-reports-server | apiregistration.k8s.io/apiservices (restricted to: v1.reports.kyverno.io) | delete · get · patch · update | Low | ResourceNameRestricted |
ClusterRole kyverno-reports-server | apiregistration.k8s.io/apiservices (restricted to: v1alpha1.openreports.io) | delete · get · patch · update | Low | ResourceNameRestricted |
ClusterRole kyverno-reports-server | apiregistration.k8s.io/apiservices (restricted to: v1alpha2.wgpolicyk8s.io) | delete · get · patch · update | Low | ResourceNameRestricted |
⚠️ Potential Abuse (2)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kyverno-reports-server | reports-server | ghcr.io/kyverno/reports-server:v0.1.6 |
🤖 kyverno-cleanup-controller
Namespace: default | Automount: ❌
🔑 Permissions (11)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role kyverno:cleanup-controller | apps/deployments | get · list · watch | Low | |
Role kyverno:cleanup-controller | discovery.k8s.io/endpointslices | list | Low | |
Role kyverno:cleanup-controller | coordination.k8s.io/leases | create | Low | |
Role kyverno:cleanup-controller | core/secrets | create | Low | |
Role kyverno:cleanup-controller | core/configmaps (restricted to: kyverno) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
Role kyverno:cleanup-controller | coordination.k8s.io/leases (restricted to: kyverno-cleanup-controller) | delete · get · patch · update | Low | ResourceNameRestricted |
Role kyverno:cleanup-controller | core/secrets (restricted to: kyverno-cleanup-controller.default.metering.kyverno-tls-ca) | delete · get · list · update · watch | Low | CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted SecretAccess |
Role kyverno:cleanup-controller | core/secrets (restricted to: kyverno-cleanup-controller.default.metering.kyverno-tls-pair) | delete · get · list · update · watch | Low | CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted SecretAccess |
Role kyverno:cleanup-controller | core/secrets (restricted to: kyverno-cleanup-controller.default.svc.kyverno-tls-ca) | delete · get · list · update · watch | Low | CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted SecretAccess |
Role kyverno:cleanup-controller | core/secrets (restricted to: kyverno-cleanup-controller.default.svc.kyverno-tls-pair) | delete · get · list · update · watch | Low | CredentialAccess DataExposure InformationDisclosure ResourceNameRestricted SecretAccess |
Role kyverno:cleanup-controller | core/configmaps (restricted to: kyverno-metrics) | get · list · watch | Low | ConfigMapAccess DataExposure InformationDisclosure ResourceNameRestricted |
⚠️ Potential Abuse (3)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kyverno-cleanup-controller | controller | reg.kyverno.io/kyverno/cleanup-controller:v1.19.1 |
🤖 kyverno-postgresql
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | kyverno-postgresql | postgresql | docker.io/bitnamilegacy/postgresql:16.1.0-debian-11-r22 |