rook-ceph

Description

File, Block, and Object Storage Services for your Cloud-Native Environment

• https://github.com/rook/rook

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 rook-ceph-system

Namespace: default  |  Automount: ❌

🔑 Permissions (100)

⚠️ Potential Abuse (18)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods in a namespace
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Read pod logs cluster-wide
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services in a namespace
• Use privileged PodSecurityPolicy (deprecated)
• Node proxy GET RCE via WebSocket

📦 Workloads (1)

🤖 rook-csi-rbd-provisioner-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (26)

⚠️ Potential Abuse (6)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps in a namespace
• Read events cluster-wide
• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-mgr

Namespace: default  |  Automount: ❌

🔑 Permissions (14)

⚠️ Potential Abuse (8)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Read pod logs in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Read events cluster-wide
• Node proxy GET RCE via WebSocket

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-cmd-reporter

Namespace: default  |  Automount: ❌

🔑 Permissions (2)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Create pods in a namespace
• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-cephfs-provisioner-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (18)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Read events cluster-wide
• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-osd

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Read ConfigMaps in a namespace

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-rbd-plugin-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (9)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-csi-cephfs-plugin-sa

Namespace: default  |  Automount: ❌

🔑 Permissions (6)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-purge-osd

Namespace: default  |  Automount: ❌

🔑 Permissions (4)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 rook-ceph-rgw

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.