kube-prometheus-stack

Description

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

• https://github.com/prometheus-community/helm-charts
• https://github.com/prometheus-operator/kube-prometheus

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 kube-prometheus-stack-kube-state-metrics

Namespace: default  |  Automount: ❌

🔑 Permissions (32)

⚠️ Potential Abuse (12)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Use privileged PodSecurityPolicy (deprecated)
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (1)

🤖 kube-prometheus-stack-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (22)

⚠️ Potential Abuse (14)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Use privileged PodSecurityPolicy (deprecated)
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 kube-prometheus-stack-grafana

Namespace: default  |  Automount: ❌

🔑 Permissions (3)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (2)

🤖 kube-prometheus-stack-prometheus

Namespace: default  |  Automount: ❌

🔑 Permissions (7)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 kube-prometheus-stack-admission

Namespace: default  |  Automount: ❌

🔑 Permissions (4)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (2)

🤖 kube-prometheus-stack-alertmanager

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 kube-prometheus-stack-grafana-test

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 kube-prometheus-stack-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (1)