rook-ceph

Description

File, Block, and Object Storage Services for your Cloud-Native Environment

• https://github.com/rook/rook

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 rook-ceph-system

Namespace: default  |  Automount: ❌

🔑 Permissions (116)

⚠️ Potential Abuse (17)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods in a namespace
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Read pod logs cluster-wide
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace

📦 Workloads (1)

🤖 rook-csi-rbd-provisioner-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (24)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Create TokenReviews (validate arbitrary tokens)
• Read CSINode Objects (Node & Storage Reconnaissance)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-mgr

Namespace: default  |  Automount: ❌

🔑 Permissions (30)

⚠️ Potential Abuse (6)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Read events cluster-wide

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-cmd-reporter

Namespace: default  |  Automount: ❌

🔑 Permissions (2)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-cephfs-provisioner-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (22)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Create TokenReviews (validate arbitrary tokens)
• Read CSINode Objects (Node & Storage Reconnaissance)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-rbd-plugin-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (8)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Create TokenReviews (validate arbitrary tokens)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-osd

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 objectstorage-provisioner

Namespace: default  |  Automount: ❌

🔑 Permissions (11)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-cephfs-plugin-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-purge-osd

Namespace: default  |  Automount: ❌

🔑 Permissions (4)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-default

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-rgw

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (0)

No workloads use this ServiceAccount.