Description
Kubernetes monitoring on VictoriaMetrics stack. Includes VictoriaMetrics Operator, Grafana dashboards, ServiceScrapes and VMRules
Overview
Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
---|---|---|---|---|---|---|
victoria-metrics-k8s-stack-grafana | default | ❌ | — | 2 | 2 | Critical |
victoria-metrics-k8s-stack-victoria-metrics-operator | default | ✅ | — | 103 | 1 | Critical |
victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | default | ❌ | — | 57 | 1 | High |
victoria-metrics-k8s-stack-kube-state-metrics | default | ✅ | — | 28 | 1 | Medium |
victoria-metrics-k8s-stack-grafana-test | default | ❌ | — | 0 | 1 | — |
victoria-metrics-k8s-stack-prometheus-node-exporter | default | ❌ | — | 0 | 1 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 victoria-metrics-k8s-stack-victoria-metrics-operator
Namespace: default
| Automount: ✅
🔑 Permissions (103)
Role | Resource | Verbs | Risk | Tags |
---|---|---|---|---|
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | rbac.authorization.k8s.io/clusterrolebindings | * | Critical | BindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | rbac.authorization.k8s.io/clusterroles | * | Critical | BindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/configmaps | * | Critical | ClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/daemonsets | * | Critical | ClusterWideAccess NodeAccess Persistence PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/deployments | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/endpoints | * | Critical | ClusterWideAccess DenialOfService ManInTheMiddle NetworkManipulation Tampering (+2 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/pods | * | Critical | ClusterWideAccess LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation (+3 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/secrets | * | Critical | ClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/serviceaccounts | * | Critical | ClusterAdminAccess ClusterWideAccess IdentityManagement Impersonation PotentialPrivilegeEscalation (+4 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/services | * | Critical | ClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/statefulsets | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | monitoring.coreos.com/* | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | rbac.authorization.k8s.io/clusterrolebindings/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | rbac.authorization.k8s.io/clusterroles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/configmaps/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/daemonsets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/deployments/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | autoscaling/horizontalpodautoscalers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | networking.k8s.io/ingresses | * | High | ClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | networking.k8s.io/ingresses/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/persistentvolumeclaims | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/persistentvolumeclaims/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | policy/poddisruptionbudgets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/replicasets | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | rbac.authorization.k8s.io/rolebindings | * | High | BindingToPrivilegedRole ClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation (+3 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | rbac.authorization.k8s.io/roles | * | High | ClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery (+2 more) |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/secrets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/serviceaccounts/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/services/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/statefulsets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apps/statefulsets/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlclusters | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlclusters/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlclusters/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlogs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlogs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlogs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlsingles | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlsingles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vlsingles/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmagents | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmagents/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmagents/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagerconfigs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagerconfigs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagerconfigs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalerts | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalerts/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmalerts/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmanomalies | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmanomalies/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmanomalies/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmauths | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmauths/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmauths/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmclusters | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmclusters/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmclusters/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmnodescrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmnodescrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmnodescrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmprobes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmprobes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmprobes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmrules | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmrules/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmrules/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmscrapeconfigs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmscrapeconfigs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmscrapeconfigs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmsingles | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmsingles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmsingles/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmstaticscrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmstaticscrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmstaticscrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmusers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmusers/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | operator.victoriametrics.com/vmusers/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/events | * | Medium | ClusterWideAccess InformationDisclosure OperationalData Reconnaissance |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | policy/poddisruptionbudgets | * | Medium | AvailabilityImpact ClusterWideAccess DenialOfService Tampering |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/configmaps/status | get · list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | apiextensions.k8s.io/customresourcedefinitions | get · list | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | discovery.k8s.io/endpointslices | get · list · watch | Low | |
Role victoria-metrics-k8s-stack-victoria-metrics-operator | coordination.k8s.io/leases | create · get · update | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/nodes | get · list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/nodes/metrics | get · list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | core/nodes/proxy | get · list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | image.openshift.io/registry/metrics | get | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | route.openshift.io/registry/metrics | get | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | image.openshift.io/routers/metrics | get | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | route.openshift.io/routers/metrics | get | Low | |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator | storage.k8s.io/storageclasses | get · list · watch | Low |
⚠️ Potential Abuse (38)
The following security risks were found based on the above permissions:
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps cluster-wide
- Modify ConfigMaps in a namespace
- Manage ClusterRoles (create, update, patch, delete)
- Manage ClusterRoleBindings (create, update, patch, delete)
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Escalate privileges via ClusterRoles (escalate verb)
- Bind ClusterRoles to identities (bind verb)
- Manage Deployments cluster-wide (potential for privileged pod execution)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets cluster-wide (runs on all nodes, high impact)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets cluster-wide
- Manage StatefulSets in a namespace
- Impersonate users, groups, or service accounts (cluster-wide)
- Manage ServiceAccounts cluster-wide
- Manage ServiceAccounts in a namespace
- Read events cluster-wide
- Manage Endpoints or EndpointSlices cluster-wide
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services cluster-wide
- Manage Services in a namespace
- Read RBAC configuration cluster-wide
- Manage PodDisruptionBudgets cluster-wide
- List Namespaces (Cluster Reconnaissance)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
Deployment | victoria-metrics-k8s-stack-victoria-metrics-operator | operator | victoriametrics/operator:v0.60.2 |
🤖 victoria-metrics-k8s-stack-grafana
Namespace: default
| Automount: ❌
🔑 Permissions (2)
Role | Resource | Verbs | Risk | Tags |
---|---|---|---|---|
ClusterRole victoria-metrics-k8s-stack-grafana-clusterrole | core/secrets | get · list · watch | Critical | ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess |
ClusterRole victoria-metrics-k8s-stack-grafana-clusterrole | core/configmaps | get · list · watch | High | ConfigMapAccess DataExposure InformationDisclosure |
⚠️ Potential Abuse (5)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
📦 Workloads (2)
Kind | Name | Container | Image |
---|---|---|---|
Deployment | victoria-metrics-k8s-stack-grafana | grafana | docker.io/grafana/grafana:12.0.2 |
Deployment | victoria-metrics-k8s-stack-grafana | grafana-sc-dashboard | quay.io/kiwigrid/k8s-sidecar:1.30.5 |
🤖 victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook
Namespace: default
| Automount: ❌
🔑 Permissions (57)
Role | Resource | Verbs | Risk | Tags |
---|---|---|---|---|
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlclusters | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlclusters/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlclusters/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlogs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlogs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlogs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlsingles | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlsingles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vlsingles/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmagents | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmagents/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmagents/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalertmanagerconfigs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalertmanagerconfigs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalertmanagerconfigs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalertmanagers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalertmanagers/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalertmanagers/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalerts | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalerts/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmalerts/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmanomalies | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmanomalies/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmanomalies/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmauths | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmauths/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmauths/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmclusters | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmclusters/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmclusters/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmnodescrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmnodescrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmnodescrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmpodscrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmpodscrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmpodscrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmprobes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmprobes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmprobes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmrules | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmrules/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmrules/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmscrapeconfigs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmscrapeconfigs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmscrapeconfigs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmservicescrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmservicescrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmservicescrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmsingles | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmsingles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmsingles/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmstaticscrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmstaticscrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmstaticscrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmusers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmusers/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | operator.victoriametrics.com/vmusers/status | * | High | ClusterWideAccess |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
Job | victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook | kubectl | bitnami/kubectl:1.20 |
🤖 victoria-metrics-k8s-stack-kube-state-metrics
Namespace: default
| Automount: ✅
🔑 Permissions (28)
Role | Resource | Verbs | Risk | Tags |
---|---|---|---|---|
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | admissionregistration.k8s.io/mutatingwebhookconfigurations | list · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | admissionregistration.k8s.io/validatingwebhookconfigurations | list · watch | Medium | InformationDisclosure Reconnaissance WebhookReconnaissance |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | certificates.k8s.io/certificatesigningrequests | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/configmaps | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | batch/cronjobs | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | apps/daemonsets | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | apps/deployments | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/endpoints | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | autoscaling/horizontalpodautoscalers | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | networking.k8s.io/ingresses | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | batch/jobs | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | coordination.k8s.io/leases | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/limitranges | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/namespaces | list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | networking.k8s.io/networkpolicies | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/nodes | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/persistentvolumeclaims | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/persistentvolumes | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | policy/poddisruptionbudgets | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/pods | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | apps/replicasets | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/replicationcontrollers | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/resourcequotas | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/secrets | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | core/services | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | apps/statefulsets | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | storage.k8s.io/storageclasses | list · watch | Low | |
ClusterRole victoria-metrics-k8s-stack-kube-state-metrics | storage.k8s.io/volumeattachments | list · watch | Low |
⚠️ Potential Abuse (4)
The following security risks were found based on the above permissions:
- List Namespaces (Cluster Reconnaissance)
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
Deployment | victoria-metrics-k8s-stack-kube-state-metrics | kube-state-metrics | registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0 |
🤖 victoria-metrics-k8s-stack-grafana-test
Namespace: default
| Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
Pod | victoria-metrics-k8s-stack-grafana-test | victoria-metrics-k8s-stack-test | docker.io/bats/bats:v1.4.1 |
🤖 victoria-metrics-k8s-stack-prometheus-node-exporter
Namespace: default
| Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
DaemonSet | victoria-metrics-k8s-stack-prometheus-node-exporter | node-exporter | quay.io/prometheus/node-exporter:v1.9.1 |