longhorn

Description

Longhorn is a distributed block storage system for Kubernetes.

• https://github.com/longhorn/longhorn
• https://github.com/longhorn/longhorn-engine
• https://github.com/longhorn/longhorn-instance-manager
• https://github.com/longhorn/longhorn-share-manager
• https://github.com/longhorn/longhorn-manager
• https://github.com/longhorn/longhorn-ui
• https://github.com/longhorn/longhorn-tests
• https://github.com/longhorn/backing-image-manager

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 longhorn-service-account

Namespace: default  |  Automount: ❌

🔑 Permissions (86)

⚠️ Potential Abuse (53)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Modify node configuration (labels, taints)
• Delete nodes
• Manage PersistentVolumes (cluster-wide storage manipulation)
• Read pod logs cluster-wide
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage ClusterRoles (create, update, patch, delete)
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Escalate privileges via ClusterRoles (escalate verb)
• Bind ClusterRoles to identities (bind verb)
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage CustomResourceDefinitions
• Manage CSIDrivers (potential node compromise)
• Manage StorageClasses
• Impersonate users, groups, or service accounts (cluster-wide)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• Use privileged PodSecurityPolicy (deprecated)
• Manage PodDisruptionBudgets cluster-wide
• Manage Leases cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• Read CSINode Objects (Node & Storage Reconnaissance)
• Manage VolumeAttachments (Cluster-wide Storage/Node Manipulation)

📦 Workloads (6)

🤖 longhorn-support-bundle

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 longhorn-ui-service-account

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)