Description

The official ngrok Kubernetes Operator.

Overview

IdentityNamespaceAutomountSecretsPermissionsWorkloadsRisk
ngrok-operatordefault551Critical
ngrok-operator-agentdefault81Critical
ngrok-operator-cleanupdefault11Low

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.


Identities

🤖 ngrok-operator

Namespace: default  |  Automount:

🔑 Permissions (55)

RoleResourceVerbsRiskTags
ClusterRole ngrok-operator-manager-rolecore/configmapscreate · delete · get · list · patch · update · watchCriticalConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering
Role ngrok-operator-leader-election-rolecoordination.k8s.io/leasescreate · delete · get · list · patch · update · watchCriticalControlPlaneDisruption CriticalNamespace DenialOfService Tampering
ClusterRole ngrok-operator-manager-rolecore/secretsget · list · watchCriticalClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
Role ngrok-operator-operator-state-rolecore/secretscreate · get · list · patch · update · watchCriticalCredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole ngrok-operator-bindings-cluster-rolecore/servicescreate · delete · get · list · patch · update · watchCriticalDenialOfService NetworkManipulation ServiceExposure Tampering
ClusterRole ngrok-operator-manager-rolecore/servicescreate · delete · get · list · patch · update · watchCriticalDenialOfService NetworkManipulation ServiceExposure Tampering
Role ngrok-operator-leader-election-rolecore/configmapscreate · delete · get · list · patch · update · watchHighConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/agentendpointscreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/agentendpoints/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/agentendpoints/statusget · patch · updateLow
ClusterRole ngrok-operator-bindings-cluster-rolebindings.k8s.ngrok.com/boundendpointscreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-bindings-cluster-rolebindings.k8s.ngrok.com/boundendpoints/finalizerspatch · updateLow
ClusterRole ngrok-operator-bindings-cluster-rolebindings.k8s.ngrok.com/boundendpoints/statusget · patch · updateLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/cloudendpointscreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/cloudendpoints/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/cloudendpoints/statusget · patch · updateLow
ClusterRole ngrok-operator-manager-roleingress.k8s.ngrok.com/domainscreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-roleingress.k8s.ngrok.com/domains/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-roleingress.k8s.ngrok.com/domains/statusget · patch · updateLow
ClusterRole ngrok-operator-manager-rolecore/eventscreate · patchLow
Role ngrok-operator-leader-election-rolecore/eventscreate · patchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/gatewayclassesget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/gatewayclasses/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/gatewayclasses/statusget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/gatewaysget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/gateways/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/gateways/statusget · list · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/httproutesget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/httproutes/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/httproutes/statusget · list · update · watchLow
ClusterRole ngrok-operator-manager-rolenetworking.k8s.io/ingressclassesget · list · watchLow
ClusterRole ngrok-operator-manager-rolenetworking.k8s.io/ingressesget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolenetworking.k8s.io/ingresses/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolenetworking.k8s.io/ingresses/statusget · list · update · watchLow
ClusterRole ngrok-operator-manager-roleingress.k8s.ngrok.com/ippoliciescreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-roleingress.k8s.ngrok.com/ippolicies/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-roleingress.k8s.ngrok.com/ippolicies/statusget · patch · updateLow
Role ngrok-operator-operator-state-rolengrok.k8s.ngrok.com/kubernetesoperatorscreate · delete · get · list · patch · update · watchLow
Role ngrok-operator-operator-state-rolengrok.k8s.ngrok.com/kubernetesoperators/finalizerspatch · updateLow
Role ngrok-operator-operator-state-rolengrok.k8s.ngrok.com/kubernetesoperators/statusget · patch · updateLow
ClusterRole ngrok-operator-manager-rolecore/namespacesget · list · update · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/ngroktrafficpoliciescreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/ngroktrafficpolicies/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolengrok.k8s.ngrok.com/ngroktrafficpolicies/statusget · patch · updateLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/referencegrantsget · list · watchLow
ClusterRole ngrok-operator-bindings-cluster-rolecore/services/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolecore/services/finalizerspatch · updateLow
ClusterRole ngrok-operator-bindings-cluster-rolecore/services/statusget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolecore/services/statusget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/tcproutesget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/tcproutes/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/tcproutes/statusget · list · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/tlsroutesget · list · patch · update · watchLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/tlsroutes/finalizerspatch · updateLow
ClusterRole ngrok-operator-manager-rolegateway.networking.k8s.io/tlsroutes/statusget · list · update · watchLow

⚠️ Potential Abuse (11)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Deploymentngrok-operator-managerngrok-operatordocker.io/ngrok/ngrok-operator:0.21.0-rc.1

🤖 ngrok-operator-agent

Namespace: default  |  Automount:

🔑 Permissions (8)

RoleResourceVerbsRiskTags
ClusterRole ngrok-operator-agent-rolecore/secretsget · list · watchCriticalClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole ngrok-operator-agent-rolengrok.k8s.ngrok.com/agentendpointsget · list · patch · update · watchLow
ClusterRole ngrok-operator-agent-rolengrok.k8s.ngrok.com/agentendpoints/finalizerspatch · updateLow
ClusterRole ngrok-operator-agent-rolengrok.k8s.ngrok.com/agentendpoints/statusget · patch · updateLow
ClusterRole ngrok-operator-agent-roleingress.k8s.ngrok.com/domainscreate · delete · get · list · patch · update · watchLow
ClusterRole ngrok-operator-agent-rolecore/eventscreate · patchLow
Role ngrok-operator-agent-operator-state-rolengrok.k8s.ngrok.com/kubernetesoperatorsget · list · watchLow
ClusterRole ngrok-operator-agent-rolengrok.k8s.ngrok.com/ngroktrafficpoliciesget · list · watchLow

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Deploymentngrok-operator-agentagentdocker.io/ngrok/ngrok-operator:0.21.0-rc.1

🤖 ngrok-operator-cleanup

Namespace: default  |  Automount:

🔑 Permissions (1)

RoleResourceVerbsRiskTags
Role ngrok-operator-cleanupngrok.k8s.ngrok.com/kubernetesoperatorsdelete · get · list · watchLow

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Jobngrok-operator-cleanupcleanupbitnami/kubectl:latest