Description

A Helm chart for Running VMCluster on Multiple Availability Zones

Overview

IdentityNamespaceAutomountSecretsPermissionsWorkloadsRisk
victoria-metrics-distributed-grafanadefault22Critical
victoria-metrics-distributed-victoria-metrics-operatordefault941Critical
victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookdefault481High
victoria-metrics-distributed-kube-state-metricsdefault321Medium
victoria-metrics-distributed-grafana-testdefault01
victoria-metrics-distributed-prometheus-node-exporterdefault01

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.


Identities

🤖 victoria-metrics-distributed-victoria-metrics-operator

Namespace: default  |  Automount:

🔑 Permissions (94)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorrbac.authorization.k8s.io/clusterrolebindings*CriticalBindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorrbac.authorization.k8s.io/clusterroles*CriticalBindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/configmaps*CriticalClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/daemonsets*CriticalClusterWideAccess NodeAccess Persistence PrivilegeEscalation Tampering (+2 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/deployments*CriticalClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/endpoints*CriticalClusterWideAccess DenialOfService ManInTheMiddle NetworkManipulation Tampering (+2 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/pods*CriticalClusterWideAccess LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation (+3 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/secrets*CriticalClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/serviceaccounts*CriticalClusterAdminAccess ClusterWideAccess IdentityManagement Impersonation PotentialPrivilegeEscalation (+4 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/services*CriticalClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/statefulsets*CriticalClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatormonitoring.coreos.com/**HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorrbac.authorization.k8s.io/clusterrolebindings/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorrbac.authorization.k8s.io/clusterroles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/configmaps/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/daemonsets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/deployments/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorautoscaling/horizontalpodautoscalers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatornetworking.k8s.io/ingresses*HighClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatornetworking.k8s.io/ingresses/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/persistentvolumeclaims*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/persistentvolumeclaims/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorpolicy/poddisruptionbudgets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/replicasets*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorrbac.authorization.k8s.io/rolebindings*HighBindingToPrivilegedRole ClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation (+3 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorrbac.authorization.k8s.io/roles*HighClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery (+2 more)
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/secrets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/serviceaccounts/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/services/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/statefulsets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapps/statefulsets/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vlogs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vlogs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vlogs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmagents*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmagents/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmagents/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagerconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagerconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagerconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagers/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalerts*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalerts/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmalerts/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmauths*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmauths/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmauths/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmclusters*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmclusters/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmclusters/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmnodescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmnodescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmnodescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmpodscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmpodscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmpodscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmprobes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmprobes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmprobes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmrules*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmrules/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmrules/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmscrapeconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmscrapeconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmscrapeconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmservicescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmservicescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmservicescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmsingles*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmsingles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmsingles/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmstaticscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmstaticscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmstaticscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmusers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmusers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatoroperator.victoriametrics.com/vmusers/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/events*MediumClusterWideAccess InformationDisclosure OperationalData Reconnaissance WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorpolicy/poddisruptionbudgets*MediumAvailabilityImpact ClusterWideAccess DenialOfService Tampering WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/configmaps/statusget · list · watchLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorapiextensions.k8s.io/customresourcedefinitionsget · listLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatordiscovery.k8s.io/endpointslicesget · list · watchLow
Role victoria-metrics-distributed-victoria-metrics-operatorcoordination.k8s.io/leasescreate · get · updateLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/namespacesget · list · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/nodesget · list · watchLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/nodes/metricsget · list · watchLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorcore/nodes/proxyget · list · watchLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorimage.openshift.io/registry/metricsgetLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorroute.openshift.io/registry/metricsgetLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorimage.openshift.io/routers/metricsgetLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorroute.openshift.io/routers/metricsgetLow
ClusterRole victoria-metrics-distributed-victoria-metrics-operatorstorage.k8s.io/storageclassesget · list · watchLow

⚠️ Potential Abuse (38)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Deploymentvictoria-metrics-distributed-victoria-metrics-operatoroperatorvictoriametrics/operator:v0.58.0

🤖 victoria-metrics-distributed-grafana

Namespace: default  |  Automount:

🔑 Permissions (2)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-distributed-grafana-clusterrolecore/secretsget · list · watchCriticalClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole victoria-metrics-distributed-grafana-clusterrolecore/configmapsget · list · watchHighConfigMapAccess DataExposure InformationDisclosure

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

📦 Workloads (2)

KindNameContainerImage
Deploymentvictoria-metrics-distributed-grafanagrafanadocker.io/grafana/grafana:11.6.0
Deploymentvictoria-metrics-distributed-grafanagrafana-sc-dashboardquay.io/kiwigrid/k8s-sidecar:1.30.0

🤖 victoria-metrics-distributed-victoria-metrics-operator-cleanup-hook

Namespace: default  |  Automount:

🔑 Permissions (48)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlogs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlogs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlogs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmagents*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmagents/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmagents/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagerconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagerconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagerconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagers/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalerts*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalerts/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalerts/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmauths*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmauths/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmauths/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmclusters*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmclusters/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmclusters/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmnodescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmnodescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmnodescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmpodscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmpodscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmpodscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmprobes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmprobes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmprobes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmrules*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmrules/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmrules/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmscrapeconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmscrapeconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmscrapeconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmservicescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmservicescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmservicescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmsingles*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmsingles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmsingles/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmstaticscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmstaticscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmstaticscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmusers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmusers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-distributed-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmusers/status*HighClusterWideAccess WildcardPermission

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Jobvictoria-metrics-distributed-victoria-metrics-operator-cleanup-hookkubectlbitnami/kubectl:1.20

🤖 victoria-metrics-distributed-kube-state-metrics

Namespace: default  |  Automount:

🔑 Permissions (32)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-distributed-kube-state-metricsadmissionregistration.k8s.io/mutatingwebhookconfigurationslist · watchMediumInformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole victoria-metrics-distributed-kube-state-metricsadmissionregistration.k8s.io/validatingwebhookconfigurationslist · watchMediumInformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole victoria-metrics-distributed-kube-state-metricscertificates.k8s.io/certificatesigningrequestslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/configmapslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsbatch/cronjobslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsapps/daemonsetslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsextensions/daemonsetslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsapps/deploymentslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsextensions/deploymentslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/endpointslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsautoscaling/horizontalpodautoscalerslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsextensions/ingresseslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsnetworking.k8s.io/ingresseslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsbatch/jobslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscoordination.k8s.io/leaseslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/limitrangeslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/namespaceslist · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole victoria-metrics-distributed-kube-state-metricsnetworking.k8s.io/networkpolicieslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/nodeslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/persistentvolumeclaimslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/persistentvolumeslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricspolicy/poddisruptionbudgetslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/podslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsapps/replicasetslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsextensions/replicasetslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/replicationcontrollerslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/resourcequotaslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/secretslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricscore/serviceslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsapps/statefulsetslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsstorage.k8s.io/storageclasseslist · watchLow
ClusterRole victoria-metrics-distributed-kube-state-metricsstorage.k8s.io/volumeattachmentslist · watchLow

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Deploymentvictoria-metrics-distributed-kube-state-metricskube-state-metricsregistry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0

🤖 victoria-metrics-distributed-grafana-test

Namespace: default  |  Automount:

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

KindNameContainerImage
Podvictoria-metrics-distributed-grafana-testvictoria-metrics-distributed-testdocker.io/bats/bats:v1.4.1

🤖 victoria-metrics-distributed-prometheus-node-exporter

Namespace: default  |  Automount:

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

KindNameContainerImage
DaemonSetvictoria-metrics-distributed-prometheus-node-exporternode-exporterquay.io/prometheus/node-exporter:v1.9.1