netobserv-operator

Description

Network Observability in Kubernetes based on eBPF.

• https://github.com/netobserv/netobserv-operator
• https://github.com/netobserv/flowlogs-pipeline
• https://github.com/netobserv/netobserv-ebpf-agent
• https://github.com/netobserv/netobserv-web-console
• https://github.com/netobserv/netobserv-cli

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 netobserv-controller-manager

Namespace: default  |  Automount: ❌

🔑 Permissions (48)

⚠️ Potential Abuse (25)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Delete namespaces
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Manage NetworkPolicies cluster-wide
• Manage NetworkPolicies in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 netobserv-operator-kube-pr-operator

Namespace: default  |  Automount: ✅

🔑 Permissions (37)

⚠️ Potential Abuse (13)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 netobserv-operator-kube-state-metrics

Namespace: default  |  Automount: ✅

🔑 Permissions (32)

⚠️ Potential Abuse (11)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (2)

🤖 netobserv-operator-prometheus-server

Namespace: default  |  Automount: ❌

🔑 Permissions (12)

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Node proxy GET RCE via WebSocket

📦 Workloads (2)

🤖 netobserv-operator-promtail

Namespace: default  |  Automount: ✅

🔑 Permissions (5)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Node proxy GET RCE via WebSocket

📦 Workloads (1)

🤖 netobserv-operator-grafana

Namespace: default  |  Automount: ✅

🔑 Permissions (2)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (5)

🤖 netobserv-operator-kube-pr-prometheus

Namespace: default  |  Automount: ✅

🔑 Permissions (7)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 netobserv-operator-filebeat

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 netobserv-operator-kube-pr-admission

Namespace: default  |  Automount: ✅

🔑 Permissions (3)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (2)

🤖 netobserv-operator-fluent-bit-loki

Namespace: default  |  Automount: ✅

🔑 Permissions (2)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 netobserv-operator-grafana-test

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (2)

🤖 netobserv-operator-alertmanager

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 netobserv-operator-kube-pr-alertmanager

Namespace: default  |  Automount: ✅

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 netobserv-operator-loki

Namespace: default  |  Automount: ✅

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 netobserv-operator-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 netobserv-operator-prometheus-pushgateway

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 netobserv-operator-prometheus-windows-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)