capsule-proxy

Description

Helm Chart for Capsule Proxy, addon for Capsule, the multi-tenant Operator

• https://github.com/projectcapsule/capsule-proxy

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 capsule-proxy

Namespace: default  |  Automount: ❌

🔑 Permissions (11)

⚠️ Potential Abuse (27)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read pod logs cluster-wide
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Impersonate users, groups, or service accounts (cluster-wide)
• Read events cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Read RBAC configuration cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)
• Read ComponentStatuses (Control Plane Reconnaissance)
• Read CSINode Objects (Node & Storage Reconnaissance)
• Read CSIStorageCapacities (Namespace Storage Reconnaissance)
• Watch All Resources in a Namespace (Broad Information Disclosure)
• Node proxy GET RCE via WebSocket

📦 Workloads (1)

🤖 capsule-proxy-crds

Namespace: default  |  Automount: ❌

🔑 Permissions (3)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Manage CustomResourceDefinitions

📦 Workloads (1)