rook-ceph

Description

File, Block, and Object Storage Services for your Cloud-Native Environment

• https://github.com/rook/rook

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 rook-ceph-system

Namespace: default  |  Automount: ❌

🔑 Permissions (46)

⚠️ Potential Abuse (25)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods in a namespace
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read pod logs cluster-wide
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services in a namespace
• Use privileged PodSecurityPolicy (deprecated)
• Manage PodDisruptionBudgets cluster-wide
• Node proxy GET RCE via WebSocket

📦 Workloads (1)

🤖 rook-csi-rbd-provisioner-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (25)

⚠️ Potential Abuse (6)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps in a namespace
• Read events cluster-wide
• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-mgr

Namespace: default  |  Automount: ❌

🔑 Permissions (9)

⚠️ Potential Abuse (8)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Read events cluster-wide
• Node proxy GET RCE via WebSocket

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-cmd-reporter

Namespace: default  |  Automount: ❌

🔑 Permissions (2)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-admission-controller

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-cephfs-provisioner-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (19)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read events cluster-wide
• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-osd

Namespace: default  |  Automount: ❌

🔑 Permissions (4)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-rbd-plugin-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (7)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-cephfs-plugin-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (6)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.