2 Service Accounts
3 Workloads
16 Bindings
1 Critical
1 Medium
14 Low
Description
OpenFaaS - Serverless Functions Made Simple
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
openfaas-controller | default | ❌ | — | 10 | 2 | Critical |
openfaas-prometheus | default | ❌ | — | 6 | 1 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 openfaas-controller
Namespace: default | Automount: ❌
🔑 Permissions (10)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role openfaas-controller | core/secrets | create · delete · get · list · patch · update · watch | Critical | CredentialAccess DataExposure InformationDisclosure Persistence PotentialPrivilegeEscalation (+2 more) |
Role openfaas-controller | core/pods/log | get · list · watch | Medium | DataExposure InformationDisclosure LogAccess |
Role openfaas-controller | apps/deployments | create · delete · get · list · update · watch | Low | |
Role openfaas-controller | extensions/deployments | create · delete · get · list · update · watch | Low | |
Role openfaas-controller | core/endpoints | get · list · watch | Low | |
Role openfaas-controller | core/namespaces | get · list · watch | Low | |
Role openfaas-controller | core/pods | get · list · watch | Low | |
Role openfaas-profiles | openfaas.com/policies | get · list · watch | Low | |
Role openfaas-profiles | openfaas.com/profiles | get · list · watch | Low | |
Role openfaas-controller | core/services | create · delete · get · list · update · watch | Low |
⚠️ Potential Abuse (4)
The following security risks were found based on the above permissions:
📦 Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | gateway | faas-netes | ghcr.io/openfaas/faas-netes:0.18.17 |
| Deployment | gateway | gateway | ghcr.io/openfaas/gateway:0.27.13 |
🤖 openfaas-prometheus
Namespace: default | Automount: ❌
🔑 Permissions (6)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role openfaas-prometheus | core/endpoints | get · list · watch | Low | |
Role openfaas-prometheus-fn | core/endpoints | get · list · watch | Low | |
Role openfaas-prometheus | core/pods | get · list · watch | Low | |
Role openfaas-prometheus-fn | core/pods | get · list · watch | Low | |
Role openfaas-prometheus | core/services | get · list · watch | Low | |
Role openfaas-prometheus-fn | core/services | get · list · watch | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | prometheus | prometheus | prom/prometheus:v3.13.0 |