stackgres-operator

Description

StackGres Operator

• https://gitlab.com/ongresinc/stackgres

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 stackgres-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (90)

⚠️ Potential Abuse (33)

The following security risks were found based on the above permissions:

• Cluster-wide pod exec
• Namespaced pod exec
• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Delete namespaces
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CronJobs cluster-wide (scheduled privileged execution, persistence)
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs cluster-wide (one-off privileged execution)
• Manage Jobs in a namespace (one-off privileged execution)
• Manage ServiceAccounts cluster-wide
• Manage ServiceAccounts in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (1)

🤖 stackgres-operator-kube-state-metrics

Namespace: default  |  Automount: ❌

🔑 Permissions (33)

⚠️ Potential Abuse (12)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Use privileged PodSecurityPolicy (deprecated)
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (1)

🤖 stackgres-operator-prometh-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (20)

⚠️ Potential Abuse (15)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Manage CustomResourceDefinitions
• Use privileged PodSecurityPolicy (deprecated)
• List Namespaces (Cluster Reconnaissance)

📦 Workloads (2)

🤖 stackgres-operator-prometh-prometheus

Namespace: default  |  Automount: ❌

🔑 Permissions (9)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)
• Node proxy GET RCE via WebSocket

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 stackgres-restapi

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (3)

The following security risks were found based on the above permissions:

• Create SubjectAccessReviews (check arbitrary permissions)
• Impersonate users, groups, or service accounts (cluster-wide)

📦 Workloads (2)

🤖 stackgres-operator-grafana

Namespace: default  |  Automount: ❌

🔑 Permissions (3)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (2)

🤖 stackgres-operator-prometh-admission

Namespace: default  |  Automount: ❌

🔑 Permissions (4)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (2)

🤖 stackgres-operator-grafana-test

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 stackgres-operator-prometh-alertmanager

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (0)

No workloads use this ServiceAccount.

🤖 stackgres-operator-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (1)

🤖 stackgres-operator-init

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (4)