openebs

Description

Containerized Attached Storage for Kubernetes

• https://github.com/openebs/openebs

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 openebs

Namespace: default  |  Automount: ❌

🔑 Permissions (36)

⚠️ Potential Abuse (41)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Node proxy access (Kubelet API)
• Modify node configuration (labels, taints)
• Delete nodes
• Manage PersistentVolumes (cluster-wide storage manipulation)
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Delete namespaces
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage MutatingWebhookConfigurations
• Manage ValidatingWebhookConfigurations
• Manage CustomResourceDefinitions
• Manage StorageClasses
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (3)

🤖 openebs-cstor-csi-controller-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (36)

⚠️ Potential Abuse (8)

The following security risks were found based on the above permissions:

• Manage Services cluster-wide
• Manage Services in a namespace
• Manage Leases cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• Read CSINode Objects (Node & Storage Reconnaissance)
• Manage VolumeAttachments (Cluster-wide Storage/Node Manipulation)

📦 Workloads (6)

🤖 openebs-jiva-csi-controller-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (36)

⚠️ Potential Abuse (8)

The following security risks were found based on the above permissions:

• Manage Services cluster-wide
• Manage Services in a namespace
• Manage Leases cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• Read CSINode Objects (Node & Storage Reconnaissance)
• Manage VolumeAttachments (Cluster-wide Storage/Node Manipulation)

📦 Workloads (5)

🤖 openebs-cstor-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (35)

⚠️ Potential Abuse (39)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Node proxy access (Kubelet API)
• Modify node configuration (labels, taints)
• Delete nodes
• Manage PersistentVolumes (cluster-wide storage manipulation)
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Delete namespaces
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage MutatingWebhookConfigurations
• Manage ValidatingWebhookConfigurations
• Manage CustomResourceDefinitions
• Manage StorageClasses
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (4)

🤖 openebs-nfs-provisioner

Namespace: default  |  Automount: ❌

🔑 Permissions (30)

⚠️ Potential Abuse (39)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Node proxy access (Kubelet API)
• Modify node configuration (labels, taints)
• Delete nodes
• Manage PersistentVolumes (cluster-wide storage manipulation)
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Delete namespaces
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage CustomResourceDefinitions
• Manage StorageClasses
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 openebs-jaeger-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (26)

⚠️ Potential Abuse (32)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• List Namespaces (Cluster Reconnaissance)
• Manage Ingresses (Namespace Service Exposure/Traffic Redirection)

📦 Workloads (1)

🤖 openebs-lvm-controller-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (26)

⚠️ Potential Abuse (9)

The following security risks were found based on the above permissions:

• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• List Namespaces (Cluster Reconnaissance)
• Read CSINode Objects (Node & Storage Reconnaissance)
• Read CSIStorageCapacities (Namespace Storage Reconnaissance)

📦 Workloads (5)

🤖 openebs-jiva-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (18)

⚠️ Potential Abuse (27)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Manage PersistentVolumes (cluster-wide storage manipulation)
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Manage PodDisruptionBudgets cluster-wide

📦 Workloads (1)

🤖 openebs-zfs-controller-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (18)

⚠️ Potential Abuse (10)

The following security risks were found based on the above permissions:

• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Delete namespaces
• Manage Services cluster-wide
• Manage Services in a namespace
• List Namespaces (Cluster Reconnaissance)
• Read CSINode Objects (Node & Storage Reconnaissance)
• Read CSIStorageCapacities (Namespace Storage Reconnaissance)

📦 Workloads (5)

🤖 openebs-localpv-provisioner

Namespace: default  |  Automount: ❌

🔑 Permissions (13)

⚠️ Potential Abuse (14)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Manage PersistentVolumes (cluster-wide storage manipulation)
• Delete namespaces
• Manage CustomResourceDefinitions
• Manage StorageClasses
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (3)

🤖 openebs-ndm

Namespace: default  |  Automount: ❌

🔑 Permissions (8)

⚠️ Potential Abuse (15)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Modify node configuration (labels, taints)
• Delete nodes
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage CustomResourceDefinitions
• Read events cluster-wide

📦 Workloads (10)

🤖 openebs-grafana

Namespace: default  |  Automount: ❌

🔑 Permissions (3)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (2)

🤖 openebs-prometheus-server

Namespace: default  |  Automount: ❌

🔑 Permissions (12)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (2)

🤖 openebs-cstor-csi-node-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (7)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read events cluster-wide

📦 Workloads (2)

🤖 openebs-jiva-csi-node-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read events cluster-wide

📦 Workloads (3)

🤖 openebs-kube-state-metrics

Namespace: default  |  Automount: ❌

🔑 Permissions (31)

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)

📦 Workloads (1)

🤖 openebs-service-account

Namespace: default  |  Automount: ❌

🔑 Permissions (21)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Read CSINode Objects (Node & Storage Reconnaissance)

📦 Workloads (2)

🤖 openebs-lvm-node-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (7)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Read events cluster-wide

📦 Workloads (2)

🤖 openebs-filebeat

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 openebs-promtail

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 openebs-fluent-bit-loki

Namespace: default  |  Automount: ❌

🔑 Permissions (2)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 openebs-grafana-test

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 openebs-loki

Namespace: default  |  Automount: ✅

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 openebs-nats

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (3)

🤖 openebs-prometheus-alertmanager

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (2)

🤖 openebs-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

🤖 openebs-prometheus-pushgateway

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)