1 Service Accounts
1 Workloads
19 Bindings
3 Critical
2 Medium
14 Low
Description
DirectPV - AIStor Volume Manager
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
directpv-min-io | directpv | — | 19 | 7 | Critical |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
directpv-min-io
Namespace: directpv | Automount:
Permissions (19)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole directpv-min-io | apiextensions.k8s.io/customresourcedefinitions | create · delete · get · list · patch · update · watch | Critical | CRDManipulation PotentialPrivilegeEscalation Tampering |
ClusterRole directpv-min-io | policy/podsecuritypolicies | use | Critical | DeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation |
ClusterRole directpv-min-io | core/secrets | get · list · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole directpv-min-io | storage.k8s.io/csinodes | get · list · watch | Medium | InformationDisclosure NodeAccess Reconnaissance StorageDetailsDisclosure |
ClusterRole directpv-min-io | core/events | create · list · patch · update · watch | Medium | InformationDisclosure OperationalData Reconnaissance |
ClusterRole directpv-min-io | directpv.min.io/directpvdrives | create · delete · get · list · update · watch | Low | |
ClusterRole directpv-min-io | directpv.min.io/directpvinitrequests | create · delete · get · list · update · watch | Low | |
ClusterRole directpv-min-io | directpv.min.io/directpvnodes | create · delete · get · list · update · watch | Low | |
ClusterRole directpv-min-io | directpv.min.io/directpvvolumes | create · delete · get · list · update · watch | Low | |
ClusterRole directpv-min-io | core/endpoints | create · delete · get · list · update · watch | Low | |
ClusterRole directpv-min-io | coordination.k8s.io/leases | create · delete · get · list · update · watch | Low | |
Role directpv-min-io | coordination.k8s.io/leases | create · delete · get · list · update · watch | Low | |
ClusterRole directpv-min-io | core/nodes | get · list · watch | Low | |
ClusterRole directpv-min-io | core/persistentvolumeclaims | get · list · update · watch | Low | |
ClusterRole directpv-min-io | core/persistentvolumeclaims/status | patch | Low | |
ClusterRole directpv-min-io | core/persistentvolumes | create · delete · get · list · patch · watch | Low | |
ClusterRole directpv-min-io | core/pods | get · list · watch | Low | |
ClusterRole directpv-min-io | storage.k8s.io/storageclasses | get · list · watch | Low | |
ClusterRole directpv-min-io | storage.k8s.io/volumeattachments | get · list · watch | Low |
Potential Abuse (7)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Manage CustomResourceDefinitions
- Read events cluster-wide
- Use privileged PodSecurityPolicy (deprecated)
- Read CSINode Objects (Node & Storage Reconnaissance)
Workloads (7)
| Kind | Name | Container | Image |
|---|---|---|---|
| DaemonSet | node-server | liveness-probe | quay.io/minio/livenessprobe@sha256:d8f7d431a2a148970dcb337f24b265d173bcee58bbeeae9af7ae60f01ce49be2 |
| DaemonSet | node-server | node-controller | quay.io/minio/directpv:v5.0.0 |
| DaemonSet | node-server | node-driver-registrar | quay.io/minio/csi-node-driver-registrar@sha256:8f00013a19bd3bea021f3e96b093814fb110b383c0fd050d2a5309afb0ed0ccb |
| DaemonSet | node-server | node-server | quay.io/minio/directpv:v5.0.0 |
| Deployment | controller | controller | quay.io/minio/directpv:v5.0.0 |
| Deployment | controller | csi-provisioner | quay.io/minio/csi-provisioner@sha256:24816a743663d153060f0c3fc30005f05bea23c8b0fd2551fd667042741e8562 |
| Deployment | controller | csi-resizer | quay.io/minio/csi-resizer@sha256:fc0c1f9cbc0ebb16283c0e425c031041eedb0e8ebbe6a1adec3de41584548ce6 |