Description

OpenTelemetry Operator Helm chart for Kubernetes

Overview

IdentityNamespaceAutomountSecretsPermissionsWorkloadsRisk
opentelemetry-operatordefault812Critical

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.


Identities

🤖 opentelemetry-operator

Namespace: default  |  Automount:

🔑 Permissions (81)

RoleResourceVerbsRiskTags
ClusterRole opentelemetry-operator-managercore/configmapscreate · delete · get · list · patch · update · watchCriticalConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering
ClusterRole opentelemetry-operator-managerapps/daemonsetscreate · delete · get · list · patch · update · watchCriticalNodeAccess Persistence PrivilegeEscalation Tampering WorkloadLifecycle
Role opentelemetry-operator-leader-electionapps/daemonsetscreate · delete · get · list · patch · update · watchCriticalNodeAccess Persistence PrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole opentelemetry-operator-managerapps/deploymentscreate · delete · get · list · patch · update · watchCriticalPersistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole opentelemetry-operator-managercore/podscreate · delete · get · list · patch · update · watchCriticalLateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+1 more)
Role opentelemetry-operator-leader-electioncore/secretsget · list · watchCriticalCredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole opentelemetry-operator-managercore/servicescreate · delete · get · list · patch · update · watchCriticalDenialOfService NetworkManipulation ServiceExposure Tampering
ClusterRole opentelemetry-operator-managerapps/statefulsetscreate · delete · get · list · patch · update · watchCriticalPersistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering WorkloadLifecycle
Role opentelemetry-operator-leader-electioncore/configmapscreate · delete · get · list · patch · update · watchHighConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering
Role opentelemetry-operator-leader-electionapps/deploymentscreate · delete · get · list · patch · update · watchHighPersistence PotentialPrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole opentelemetry-operator-managernetworking.k8s.io/ingressescreate · delete · get · list · patch · update · watchHighDenialOfService NetworkManipulation ServiceExposure Tampering
Role opentelemetry-operator-leader-electionnetworking.k8s.io/ingressescreate · delete · get · list · patch · update · watchHighDenialOfService NetworkManipulation ServiceExposure Tampering
Role opentelemetry-operator-leader-electioncore/podscreate · delete · get · list · patch · update · watchHighLateralMovement Persistence PotentialPrivilegeEscalation Tampering WorkloadExecution
ClusterRole opentelemetry-operator-managercore/serviceaccountscreate · delete · get · list · patch · update · watchHighIdentityManagement PotentialPrivilegeEscalation Tampering
Role opentelemetry-operator-leader-electioncore/servicescreate · delete · get · list · patch · update · watchHighDenialOfService NetworkManipulation ServiceExposure Tampering
Role opentelemetry-operator-leader-electionapps/statefulsetscreate · delete · get · list · patch · update · watchHighPersistence PotentialPrivilegeEscalation Tampering WorkloadLifecycle
ClusterRole opentelemetry-operator-managercore/eventscreate · get · list · patch · watchMediumInformationDisclosure OperationalData Reconnaissance
ClusterRole opentelemetry-operator-managerpolicy/poddisruptionbudgetscreate · delete · get · list · patch · update · watchMediumAvailabilityImpact DenialOfService Tampering
ClusterRole opentelemetry-operator-managercore/resourcequotasget · list · watchMediumInformationDisclosure QuotaTampering Reconnaissance ResourceConfiguration
Role opentelemetry-operator-leader-electioncore/serviceaccountscreate · delete · get · list · patch · update · watchMediumIdentityManagement PotentialPrivilegeEscalation Tampering
ClusterRole opentelemetry-operator-managerauthorization.k8s.io/subjectaccessreviewscreateMediumInformationDisclosure RBACQuery
ClusterRole opentelemetry-operator-proxyauthentication.k8s.io/tokenreviewscreateMediumCredentialAccess InformationDisclosure RBACQuery
ClusterRole opentelemetry-operator-managercert-manager.io/certificaterequestscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managercert-manager.io/certificatescreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managerbatch/cronjobsget · list · watchLow
ClusterRole opentelemetry-operator-managerextensions/daemonsetsget · list · watchLow
ClusterRole opentelemetry-operator-managerextensions/deploymentsget · list · watchLow
Role opentelemetry-operator-leader-electioncore/eventscreate · patchLow
ClusterRole opentelemetry-operator-managerevents.k8s.io/eventslist · watchLow
ClusterRole opentelemetry-operator-managerautoscaling/horizontalpodautoscalerscreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionautoscaling/horizontalpodautoscalerscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managerconfig.openshift.io/infrastructuresget · list · watchLow
Role opentelemetry-operator-leader-electionconfig.openshift.io/infrastructuresget · list · watchLow
ClusterRole opentelemetry-operator-managerconfig.openshift.io/infrastructures/statusget · list · watchLow
Role opentelemetry-operator-leader-electionconfig.openshift.io/infrastructures/statusget · list · watchLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/instrumentationsget · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionopentelemetry.io/instrumentationsget · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managercert-manager.io/issuerscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managerbatch/jobsget · list · watchLow
Role opentelemetry-operator-leader-electionbatch/jobsget · list · watchLow
ClusterRole opentelemetry-operator-managercoordination.k8s.io/leasescreate · get · list · updateLow
Role opentelemetry-operator-leader-electioncoordination.k8s.io/leasescreate · get · list · updateLow
ClusterRole opentelemetry-operator-managercore/namespaceslist · watchLowClusterStructure InformationDisclosure Reconnaissance
Role opentelemetry-operator-leader-electioncore/namespacesget · list · watchLow
ClusterRole opentelemetry-operator-managercore/namespaces/statusget · list · watchLow
ClusterRole opentelemetry-operator-managercore/nodes/proxygetLow
ClusterRole opentelemetry-operator-managercore/nodes/specget · list · watchLow
ClusterRole opentelemetry-operator-managercore/nodes/statsgetLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/opampbridgescreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionopentelemetry.io/opampbridgescreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/opampbridges/finalizersupdateLow
Role opentelemetry-operator-leader-electionopentelemetry.io/opampbridges/finalizersupdateLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/opampbridges/statusget · patch · updateLow
Role opentelemetry-operator-leader-electionopentelemetry.io/opampbridges/statusget · patch · updateLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/opentelemetrycollectorsget · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionopentelemetry.io/opentelemetrycollectorsget · list · patch · update · watchLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/opentelemetrycollectors/finalizersget · patch · updateLow
Role opentelemetry-operator-leader-electionopentelemetry.io/opentelemetrycollectors/finalizersget · patch · updateLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/opentelemetrycollectors/statusget · patch · updateLow
Role opentelemetry-operator-leader-electionopentelemetry.io/opentelemetrycollectors/statusget · patch · updateLow
ClusterRole opentelemetry-operator-managercore/persistentvolumeclaimscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managercore/persistentvolumescreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionpolicy/poddisruptionbudgetscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managermonitoring.coreos.com/podmonitorscreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionmonitoring.coreos.com/podmonitorscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managercore/pods/statusget · list · watchLow
ClusterRole opentelemetry-operator-managerapps/replicasetsget · list · watchLow
Role opentelemetry-operator-leader-electionapps/replicasetsget · list · watchLow
ClusterRole opentelemetry-operator-managerextensions/replicasetsget · list · watchLow
ClusterRole opentelemetry-operator-managercore/replicationcontrollersget · list · watchLow
ClusterRole opentelemetry-operator-managercore/replicationcontrollers/statusget · list · watchLow
ClusterRole opentelemetry-operator-managerroute.openshift.io/routescreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionroute.openshift.io/routescreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managerroute.openshift.io/routes/custom-hostcreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionroute.openshift.io/routes/custom-hostcreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-managermonitoring.coreos.com/servicemonitorscreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionmonitoring.coreos.com/servicemonitorscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/targetallocatorscreate · delete · get · list · patch · update · watchLow
Role opentelemetry-operator-leader-electionopentelemetry.io/targetallocatorscreate · delete · get · list · patch · update · watchLow
ClusterRole opentelemetry-operator-manageropentelemetry.io/targetallocators/statusget · patch · updateLow
Role opentelemetry-operator-leader-electionopentelemetry.io/targetallocators/statusget · patch · updateLow

⚠️ Potential Abuse (28)

The following security risks were found based on the above permissions:

📦 Workloads (2)

KindNameContainerImage
Deploymentopentelemetry-operatorkube-rbac-proxyquay.io/brancz/kube-rbac-proxy:v0.19.1
Deploymentopentelemetry-operatormanagerghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.126.0