operator

Description

Redpanda operator helm chart

• https://github.com/redpanda-data/redpanda-operator/tree/main/operator/chart

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 operator

Namespace: default  |  Automount: ❌

🔑 Permissions (89)

⚠️ Potential Abuse (25)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets in a namespace
• Read pod logs cluster-wide
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Manage ClusterRoles (create, update, patch, delete)
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage StatefulSets in a namespace
• Manage Jobs in a namespace (one-off privileged execution)
• Create TokenReviews (validate arbitrary tokens)
• Create SubjectAccessReviews (check arbitrary permissions)
• Manage ServiceAccounts in a namespace
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• Manage Leases in kube-system or kube-node-lease namespace
• Manage Ingresses (Namespace Service Exposure/Traffic Redirection)

📦 Workloads (1)