Description

Kubernetes monitoring on VictoriaMetrics stack. Includes VictoriaMetrics Operator, Grafana dashboards, ServiceScrapes and VMRules

Overview

IdentityNamespaceAutomountSecretsPermissionsWorkloadsRisk
victoria-metrics-k8s-stack-grafanadefault22Critical
victoria-metrics-k8s-stack-victoria-metrics-operatordefault1031Critical
victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookdefault571High
victoria-metrics-k8s-stack-kube-state-metricsdefault281Medium
victoria-metrics-k8s-stack-grafana-testdefault01
victoria-metrics-k8s-stack-prometheus-node-exporterdefault01

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.


Identities

🤖 victoria-metrics-k8s-stack-victoria-metrics-operator

Namespace: default  |  Automount:

🔑 Permissions (103)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorrbac.authorization.k8s.io/clusterrolebindings*CriticalBindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorrbac.authorization.k8s.io/clusterroles*CriticalBindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/configmaps*CriticalClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/daemonsets*CriticalClusterWideAccess NodeAccess Persistence PrivilegeEscalation Tampering (+2 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/deployments*CriticalClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/endpoints*CriticalClusterWideAccess DenialOfService ManInTheMiddle NetworkManipulation Tampering (+2 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/pods*CriticalClusterWideAccess LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation (+3 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/secrets*CriticalClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/serviceaccounts*CriticalClusterAdminAccess ClusterWideAccess IdentityManagement Impersonation PotentialPrivilegeEscalation (+4 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/services*CriticalClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/statefulsets*CriticalClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatormonitoring.coreos.com/**HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorrbac.authorization.k8s.io/clusterrolebindings/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorrbac.authorization.k8s.io/clusterroles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/configmaps/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/daemonsets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/deployments/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorautoscaling/horizontalpodautoscalers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatornetworking.k8s.io/ingresses*HighClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatornetworking.k8s.io/ingresses/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/persistentvolumeclaims*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/persistentvolumeclaims/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorpolicy/poddisruptionbudgets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/replicasets*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorrbac.authorization.k8s.io/rolebindings*HighBindingToPrivilegedRole ClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation (+3 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorrbac.authorization.k8s.io/roles*HighClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery (+2 more)
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/secrets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/serviceaccounts/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/services/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/statefulsets/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapps/statefulsets/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlclusters*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlclusters/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlclusters/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlogs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlogs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlogs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlsingles*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlsingles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vlsingles/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmagents*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmagents/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmagents/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagerconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagerconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagerconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalertmanagers/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalerts*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalerts/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmalerts/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmanomalies*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmanomalies/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmanomalies/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmauths*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmauths/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmauths/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmclusters*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmclusters/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmclusters/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmnodescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmnodescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmnodescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmpodscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmpodscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmpodscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmprobes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmprobes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmprobes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmrules*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmrules/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmrules/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmscrapeconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmscrapeconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmscrapeconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmservicescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmservicescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmservicescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmsingles*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmsingles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmsingles/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmstaticscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmstaticscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmstaticscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmusers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmusers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatoroperator.victoriametrics.com/vmusers/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/events*MediumClusterWideAccess InformationDisclosure OperationalData Reconnaissance WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorpolicy/poddisruptionbudgets*MediumAvailabilityImpact ClusterWideAccess DenialOfService Tampering WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/configmaps/statusget · list · watchLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorapiextensions.k8s.io/customresourcedefinitionsget · listLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatordiscovery.k8s.io/endpointslicesget · list · watchLow
Role victoria-metrics-k8s-stack-victoria-metrics-operatorcoordination.k8s.io/leasescreate · get · updateLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/namespacesget · list · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/nodesget · list · watchLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/nodes/metricsget · list · watchLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorcore/nodes/proxyget · list · watchLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorimage.openshift.io/registry/metricsgetLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorroute.openshift.io/registry/metricsgetLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorimage.openshift.io/routers/metricsgetLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorroute.openshift.io/routers/metricsgetLow
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operatorstorage.k8s.io/storageclassesget · list · watchLow

⚠️ Potential Abuse (38)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Deploymentvictoria-metrics-k8s-stack-victoria-metrics-operatoroperatorvictoriametrics/operator:v0.60.2

🤖 victoria-metrics-k8s-stack-grafana

Namespace: default  |  Automount:

🔑 Permissions (2)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-k8s-stack-grafana-clusterrolecore/secretsget · list · watchCriticalClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole victoria-metrics-k8s-stack-grafana-clusterrolecore/configmapsget · list · watchHighConfigMapAccess DataExposure InformationDisclosure

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

📦 Workloads (2)

KindNameContainerImage
Deploymentvictoria-metrics-k8s-stack-grafanagrafanadocker.io/grafana/grafana:12.0.2
Deploymentvictoria-metrics-k8s-stack-grafanagrafana-sc-dashboardquay.io/kiwigrid/k8s-sidecar:1.30.5

🤖 victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hook

Namespace: default  |  Automount:

🔑 Permissions (57)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlclusters*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlclusters/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlclusters/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlogs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlogs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlogs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlsingles*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlsingles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vlsingles/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmagents*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmagents/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmagents/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagerconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagerconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagerconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalertmanagers/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalerts*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalerts/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmalerts/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmanomalies*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmanomalies/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmanomalies/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmauths*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmauths/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmauths/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmclusters*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmclusters/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmclusters/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmnodescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmnodescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmnodescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmpodscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmpodscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmpodscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmprobes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmprobes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmprobes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmrules*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmrules/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmrules/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmscrapeconfigs*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmscrapeconfigs/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmscrapeconfigs/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmservicescrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmservicescrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmservicescrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmsingles*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmsingles/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmsingles/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmstaticscrapes*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmstaticscrapes/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmstaticscrapes/status*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmusers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmusers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole victoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookoperator.victoriametrics.com/vmusers/status*HighClusterWideAccess WildcardPermission

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Jobvictoria-metrics-k8s-stack-victoria-metrics-operator-cleanup-hookkubectlbitnami/kubectl:1.20

🤖 victoria-metrics-k8s-stack-kube-state-metrics

Namespace: default  |  Automount:

🔑 Permissions (28)

RoleResourceVerbsRiskTags
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsadmissionregistration.k8s.io/mutatingwebhookconfigurationslist · watchMediumInformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsadmissionregistration.k8s.io/validatingwebhookconfigurationslist · watchMediumInformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscertificates.k8s.io/certificatesigningrequestslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/configmapslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsbatch/cronjobslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsapps/daemonsetslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsapps/deploymentslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/endpointslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsautoscaling/horizontalpodautoscalerslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsnetworking.k8s.io/ingresseslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsbatch/jobslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscoordination.k8s.io/leaseslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/limitrangeslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/namespaceslist · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsnetworking.k8s.io/networkpolicieslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/nodeslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/persistentvolumeclaimslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/persistentvolumeslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricspolicy/poddisruptionbudgetslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/podslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsapps/replicasetslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/replicationcontrollerslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/resourcequotaslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/secretslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricscore/serviceslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsapps/statefulsetslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsstorage.k8s.io/storageclasseslist · watchLow
ClusterRole victoria-metrics-k8s-stack-kube-state-metricsstorage.k8s.io/volumeattachmentslist · watchLow

⚠️ Potential Abuse (4)

The following security risks were found based on the above permissions:

📦 Workloads (1)

KindNameContainerImage
Deploymentvictoria-metrics-k8s-stack-kube-state-metricskube-state-metricsregistry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0

🤖 victoria-metrics-k8s-stack-grafana-test

Namespace: default  |  Automount:

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

KindNameContainerImage
Podvictoria-metrics-k8s-stack-grafana-testvictoria-metrics-k8s-stack-testdocker.io/bats/bats:v1.4.1

🤖 victoria-metrics-k8s-stack-prometheus-node-exporter

Namespace: default  |  Automount:

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (1)

KindNameContainerImage
DaemonSetvictoria-metrics-k8s-stack-prometheus-node-exporternode-exporterquay.io/prometheus/node-exporter:v1.9.1