5 Service Accounts
6 Workloads
25 Bindings
1 Critical
1 High
23 Low
Description
Operator to manage NetBox resources directly through Kubernetes
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
netbox-operator | default | ✅ | — | 22 | 1 | Critical |
netbox-operator-netbox-app | default | ❌ | — | 3 | 3 | Low |
netbox-operator-postgresql | default | ❌ | — | 0 | 1 | — |
netbox-operator-valkey-primary | default | ❌ | — | 0 | 1 | — |
netbox-operator-valkey-replica | default | ❌ | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 netbox-operator
Namespace: default | Automount: ✅
🔑 Permissions (22)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role netbox-operator-leader-election | coordination.k8s.io/leases | create · delete · get · list · patch · update · watch | Critical | ControlPlaneDisruption CriticalNamespace DenialOfService Tampering |
Role netbox-operator-leader-election | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
ClusterRole netbox-operator | core/events | create · patch | Low | |
Role netbox-operator-leader-election | core/events | create · patch | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddressclaims | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddressclaims/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddressclaims/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddresses | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddresses/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/ipaddresses/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/iprangeclaims | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/iprangeclaims/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/iprangeclaims/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/ipranges | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/ipranges/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/ipranges/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixclaims | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/prefixclaims/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixclaims/status | get · patch · update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole netbox-operator | netbox.dev/prefixes/finalizers | update | Low | |
ClusterRole netbox-operator | netbox.dev/prefixes/status | get · patch · update | Low |
⚠️ Potential Abuse (4)
The following security risks were found based on the above permissions:
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Leases in kube-system or kube-node-lease namespace
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | netbox-operator | netbox-operator | ghcr.io/netbox-community/netbox-operator:0.2.4 |
🤖 netbox-operator-netbox-app
Namespace: default | Automount: ❌
🔑 Permissions (3)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role netbox-operator-netbox-app | apps/deployments | get · list · watch | Low | |
Role netbox-operator-netbox-app | apps/replicasets | get · list · watch | Low | |
Role netbox-operator-netbox-app | apps/statefulsets | get · list · watch | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (3)
| Kind | Name | Container | Image |
|---|---|---|---|
| CronJob | netbox-operator-netbox-app-housekeeping | netbox-housekeeping | ghcr.io/netbox-community/netbox:v4.3.3 |
| Deployment | netbox-operator-netbox-app | netbox | ghcr.io/netbox-community/netbox:v4.3.3 |
| Deployment | netbox-operator-netbox-app-worker | netbox-worker | ghcr.io/netbox-community/netbox:v4.3.3 |
🤖 netbox-operator-postgresql
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | netbox-operator-postgresql | postgresql | docker.io/bitnami/postgresql:17.5.0-debian-12-r16 |
🤖 netbox-operator-valkey-primary
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | netbox-operator-valkey-primary | valkey | docker.io/bitnami/valkey:8.1.2-debian-12-r0 |
🤖 netbox-operator-valkey-replica
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | netbox-operator-valkey-replicas | valkey | docker.io/bitnami/valkey:8.1.2-debian-12-r0 |