1 Service Accounts
1 Workloads
31 Bindings
7 Critical
4 High
1 Medium
19 Low
Description
Victoria Metrics Operator
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
victoria-metrics-operator | default | ❌ | — | 31 | 1 | Critical |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 victoria-metrics-operator
Namespace: default | Automount: ❌
🔑 Permissions (31)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole victoria-metrics-operator | core/configmaps | * | Critical | ClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more) |
ClusterRole victoria-metrics-operator | apps/deployments | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | core/endpoints | * | Critical | ClusterWideAccess DenialOfService ManInTheMiddle NetworkManipulation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | core/pods | * | Critical | ClusterWideAccess LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation (+3 more) |
ClusterRole victoria-metrics-operator | core/secrets | * | Critical | ClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more) |
ClusterRole victoria-metrics-operator | core/services | * | Critical | ClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more) |
ClusterRole victoria-metrics-operator | apps/statefulsets | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | monitoring.coreos.com/* | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/persistentvolumeclaims | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | apps/replicasets | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/services/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/events | * | Medium | ClusterWideAccess InformationDisclosure OperationalData Reconnaissance |
ClusterRole victoria-metrics-operator | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmagents | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmagents/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalerts | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalerts/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmclusters | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmclusters/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmprobes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmprobes/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmrules | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmrules/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes/status | get · patch · update | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmsingles | create · delete · get · list · patch · update · watch | Low | |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmsingles/status | get · patch · update | Low |
⚠️ Potential Abuse (24)
The following security risks were found based on the above permissions:
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps cluster-wide
- Modify ConfigMaps in a namespace
- Manage Deployments cluster-wide (potential for privileged pod execution)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage StatefulSets cluster-wide
- Manage StatefulSets in a namespace
- Read events cluster-wide
- Manage Endpoints or EndpointSlices cluster-wide
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services cluster-wide
- Manage Services in a namespace
- List Namespaces (Cluster Reconnaissance)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | victoria-metrics-operator | victoria-metrics-operator | victoriametrics/operator:v0.2.1 |