Description

DEPRECATED: Use linkerd-crds and linkerd-control-plane for Linkerd 2.12.0 and later (see https://linkerd.io/2.12/tasks/upgrade/#upgrading-to-2-12-0-using-helm) - Linkerd gives you observability, reliability, and security for your microservices — with no code change required.

Overview

IdentityNamespaceAutomountSecretsPermissionsWorkloadsRisk
linkerd-identitylinkerd32Medium
linkerd-destinationlinkerd124Low
linkerd-heartbeatlinkerd31Low
linkerd-proxy-injectorlinkerd162Low

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.


Identities

🤖 linkerd-identity

Namespace: linkerd  |  Automount:

🔑 Permissions (3)

RoleResourceVerbsRiskTags
ClusterRole linkerd-linkerd-identityauthentication.k8s.io/tokenreviewscreateMediumCredentialAccess InformationDisclosure RBACQuery
ClusterRole linkerd-linkerd-identityapps/deploymentsgetLow
ClusterRole linkerd-linkerd-identitycore/eventscreate · patchLow

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

📦 Workloads (2)

KindNameContainerImage
Deploymentlinkerd-identityidentitycr.l5d.io/linkerd/controller:stable-2.11.5
Deploymentlinkerd-identitylinkerd-proxycr.l5d.io/linkerd/proxy:stable-2.11.5

🤖 linkerd-proxy-injector

Namespace: linkerd  |  Automount:

🔑 Permissions (16)

RoleResourceVerbsRiskTags
ClusterRole linkerd-linkerd-proxy-injectorbatch/cronjobsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorextensions/cronjobsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorapps/daemonsetsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorextensions/daemonsetsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorapps/deploymentsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorextensions/deploymentsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorcore/eventscreate · patchLow
ClusterRole linkerd-linkerd-proxy-injectorbatch/jobsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorextensions/jobsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorcore/namespacesget · list · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole linkerd-linkerd-proxy-injectorcore/podslist · watchLow
ClusterRole linkerd-linkerd-proxy-injectorapps/replicasetsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorextensions/replicasetsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorcore/replicationcontrollersget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorapps/statefulsetsget · list · watchLow
ClusterRole linkerd-linkerd-proxy-injectorextensions/statefulsetsget · list · watchLow

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

📦 Workloads (2)

KindNameContainerImage
Deploymentlinkerd-proxy-injectorlinkerd-proxycr.l5d.io/linkerd/proxy:stable-2.11.5
Deploymentlinkerd-proxy-injectorproxy-injectorcr.l5d.io/linkerd/controller:stable-2.11.5

🤖 linkerd-destination

Namespace: linkerd  |  Automount:

🔑 Permissions (12)

RoleResourceVerbsRiskTags
ClusterRole linkerd-linkerd-destinationcore/endpointsget · list · watchLow
ClusterRole linkerd-linkerd-destinationbatch/jobsget · list · watchLow
ClusterRole linkerd-linkerd-destinationcore/namespacesget · list · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole linkerd-linkerd-destinationcore/nodesget · list · watchLow
ClusterRole linkerd-linkerd-destinationcore/podsget · list · watchLow
ClusterRole linkerd-policycore/podsget · list · watchLow
ClusterRole linkerd-linkerd-destinationapps/replicasetsget · list · watchLow
ClusterRole linkerd-policypolicy.linkerd.io/serverauthorizationsget · list · watchLow
ClusterRole linkerd-policypolicy.linkerd.io/serversget · list · watchLow
ClusterRole linkerd-linkerd-destinationlinkerd.io/serviceprofilesget · list · watchLow
ClusterRole linkerd-linkerd-destinationcore/servicesget · list · watchLow
ClusterRole linkerd-linkerd-destinationsplit.smi-spec.io/trafficsplitsget · list · watchLow

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

📦 Workloads (4)

KindNameContainerImage
Deploymentlinkerd-destinationdestinationcr.l5d.io/linkerd/controller:stable-2.11.5
Deploymentlinkerd-destinationlinkerd-proxycr.l5d.io/linkerd/proxy:stable-2.11.5
Deploymentlinkerd-destinationpolicycr.l5d.io/linkerd/policy-controller:stable-2.11.5
Deploymentlinkerd-destinationsp-validatorcr.l5d.io/linkerd/controller:stable-2.11.5

🤖 linkerd-heartbeat

Namespace: linkerd  |  Automount:

🔑 Permissions (3)

RoleResourceVerbsRiskTags
Role linkerd-heartbeatcore/configmapsgetLow
ClusterRole linkerd-heartbeatcore/namespaceslistLow
ClusterRole linkerd-heartbeatlinkerd.io/serviceprofileslistLow

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
CronJoblinkerd-heartbeatheartbeatcr.l5d.io/linkerd/controller:stable-2.11.5