victoria-metrics-k8s-stack

Description

Kubernetes monitoring on VictoriaMetrics stack. Includes VictoriaMetrics Operator, Grafana dashboards, ServiceScrapes and VMRules

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 victoria-metrics-k8s-stack-victoria-metrics-operator

Namespace: default  |  Automount: ❌

🔑 Permissions (92)

⚠️ Potential Abuse (33)

The following security risks were found based on the above permissions:

• Create pods cluster-wide
• Create pods in a namespace
• Update/Patch pods cluster-wide
• Update/Patch pods in a namespace
• Read secrets cluster-wide
• Read secrets in a namespace
• Modify secrets cluster-wide
• Modify secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• Modify ConfigMaps cluster-wide
• Modify ConfigMaps in a namespace
• Manage ClusterRoles (create, update, patch, delete)
• Manage ClusterRoleBindings (create, update, patch, delete)
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage Deployments cluster-wide (potential for privileged pod execution)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage StatefulSets cluster-wide
• Manage StatefulSets in a namespace
• Read events cluster-wide
• Manage Endpoints or EndpointSlices cluster-wide
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services cluster-wide
• Manage Services in a namespace
• Read RBAC configuration cluster-wide
• Use privileged PodSecurityPolicy (deprecated)
• Manage PodDisruptionBudgets cluster-wide
• List Namespaces (Cluster Reconnaissance)
• Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
• Node proxy GET RCE via WebSocket

📦 Workloads (1)

🤖 victoria-metrics-k8s-stack-kube-state-metrics

Namespace: default  |  Automount: ❌

🔑 Permissions (31)

⚠️ Potential Abuse (11)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace
• List Namespaces (Cluster Reconnaissance)
• List ValidatingWebhookConfigurations (Reconnaissance)
• List MutatingWebhookConfigurations (Reconnaissance)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Read All ResourceQuotas (Cluster-wide Information Disclosure)

📦 Workloads (1)

🤖 victoria-metrics-k8s-stack-grafana

Namespace: default  |  Automount: ❌

🔑 Permissions (3)

⚠️ Potential Abuse (5)

The following security risks were found based on the above permissions:

• Read secrets cluster-wide
• Read secrets in a namespace
• Read ConfigMaps cluster-wide
• Read ConfigMaps in a namespace

📦 Workloads (3)

🤖 victoria-metrics-k8s-stack-cleanup-hook

Namespace: default  |  Automount: ❌

🔑 Permissions (5)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 victoria-metrics-k8s-stack-grafana-test

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (1)

The following security risks were found based on the above permissions:

📦 Workloads (1)

🤖 victoria-metrics-k8s-stack-prometheus-node-exporter

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (2)

The following security risks were found based on the above permissions:

• Use privileged PodSecurityPolicy (deprecated)

📦 Workloads (1)

🤖 victoria-metrics-k8s-stack

Namespace: default  |  Automount: ❌

🔑 Permissions (0)

No explicit RBAC bindings.

📦 Workloads (0)

No workloads use this ServiceAccount.