5 Service Accounts
6 Workloads
16 Bindings
1 Critical
1 High
14 Low
Description
Operator to manage NetBox resources directly through Kubernetes
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
netbox-operator | default | ✅ | — | 16 | 1 | Critical |
netbox-operator-netbox-app | default | ❌ | — | 0 | 3 | — |
netbox-operator-postgresql | default | ❌ | — | 0 | 1 | — |
netbox-operator-redis-master | default | ❌ | — | 0 | 1 | — |
netbox-operator-redis-replica | default | ❌ | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 netbox-operator
Namespace: default | Automount: ✅
🔑 Permissions (16)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role netbox-operator-leader-election | coordination.k8s.io/leases | create · delete · get · list · patch · update · watch | Critical | ControlPlaneDisruption CriticalNamespace DenialOfService Tampering |
Role netbox-operator-leader-election | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
ClusterRole netbox-operator | core/events | create · patch | Low | |
Role netbox-operator-leader-election | core/events | create · patch | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddressclaims | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddressclaims/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddressclaims/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddresses | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddresses/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddresses/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixclaims | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/prefixclaims/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixclaims/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/prefixes/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixes/status | get · patch · update | Low |
⚠️ Potential Abuse (4)
The following security risks were found based on the above permissions:
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | netbox-operator | netbox-operator | ghcr.io/netbox-community/netbox-operator:v0.1.0-alpha.6 |
🤖 netbox-operator-netbox-app
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (3)
| Kind | Name | Container | Image |
|---|---|---|---|
| CronJob | netbox-operator-netbox-app-housekeeping | netbox-housekeeping | ghcr.io/netbox-community/netbox:v4.2.5 |
| Deployment | netbox-operator-netbox-app | netbox | ghcr.io/netbox-community/netbox:v4.2.5 |
| Deployment | netbox-operator-netbox-app-worker | netbox-worker | ghcr.io/netbox-community/netbox:v4.2.5 |
🤖 netbox-operator-postgresql
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | netbox-operator-postgresql | postgresql | docker.io/bitnami/postgresql:17.4.0-debian-12-r10 |
🤖 netbox-operator-redis-master
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | netbox-operator-redis-master | redis | docker.io/bitnami/redis:7.4.2-debian-12-r4 |
🤖 netbox-operator-redis-replica
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | netbox-operator-redis-replicas | redis | docker.io/bitnami/redis:7.4.2-debian-12-r4 |