tigera-operator

Description

Installs the Tigera operator for Calico

• https://github.com/projectcalico/calico/tree/master/charts/tigera-operator
• https://github.com/tigera/operator
• https://github.com/projectcalico/calico

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 tigera-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (64)

⚠️ Potential Abuse (22)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Delete namespaces
• Escalate privileges via ClusterRoles (escalate verb)
• Bind ClusterRoles to identities (bind verb)
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets cluster-wide (runs on all nodes, high impact)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Read events cluster-wide
• Read RBAC configuration cluster-wide
• Use privileged PodSecurityPolicy (deprecated)
• List Namespaces (Cluster Reconnaissance)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (2)