1 Service Accounts
1 Workloads
103 Bindings
11 Critical
77 High
2 Medium
13 Low
Description
VictoriaMetrics Operator
Overview
Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
---|---|---|---|---|---|---|
victoria-metrics-operator | default | ✅ | — | 103 | 1 | Critical |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 victoria-metrics-operator
Namespace: default
| Automount: ✅
🔑 Permissions (103)
Role | Resource | Verbs | Risk | Tags |
---|---|---|---|---|
ClusterRole victoria-metrics-operator | rbac.authorization.k8s.io/clusterrolebindings | * | Critical | BindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more) |
ClusterRole victoria-metrics-operator | rbac.authorization.k8s.io/clusterroles | * | Critical | BindingToPrivilegedRole ClusterAdminAccess ClusterWideAccess InformationDisclosure PrivilegeEscalation (+4 more) |
ClusterRole victoria-metrics-operator | core/configmaps | * | Critical | ClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more) |
ClusterRole victoria-metrics-operator | apps/daemonsets | * | Critical | ClusterWideAccess NodeAccess Persistence PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | apps/deployments | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | core/endpoints | * | Critical | ClusterWideAccess DenialOfService ManInTheMiddle NetworkManipulation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | core/pods | * | Critical | ClusterWideAccess LateralMovement Persistence PotentialPrivilegeEscalation PrivilegeEscalation (+3 more) |
ClusterRole victoria-metrics-operator | core/secrets | * | Critical | ClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more) |
ClusterRole victoria-metrics-operator | core/serviceaccounts | * | Critical | ClusterAdminAccess ClusterWideAccess IdentityManagement Impersonation PotentialPrivilegeEscalation (+4 more) |
ClusterRole victoria-metrics-operator | core/services | * | Critical | ClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more) |
ClusterRole victoria-metrics-operator | apps/statefulsets | * | Critical | ClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more) |
ClusterRole victoria-metrics-operator | monitoring.coreos.com/* | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | rbac.authorization.k8s.io/clusterrolebindings/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | rbac.authorization.k8s.io/clusterroles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/configmaps/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | apps/daemonsets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | apps/deployments/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | autoscaling/horizontalpodautoscalers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | networking.k8s.io/ingresses | * | High | ClusterWideAccess DenialOfService NetworkManipulation ServiceExposure Tampering (+1 more) |
ClusterRole victoria-metrics-operator | networking.k8s.io/ingresses/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/persistentvolumeclaims | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/persistentvolumeclaims/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | policy/poddisruptionbudgets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | apps/replicasets | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | rbac.authorization.k8s.io/rolebindings | * | High | BindingToPrivilegedRole ClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation (+3 more) |
ClusterRole victoria-metrics-operator | rbac.authorization.k8s.io/roles | * | High | ClusterWideAccess InformationDisclosure PrivilegeEscalation RBACManipulation RBACQuery (+2 more) |
ClusterRole victoria-metrics-operator | core/secrets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/serviceaccounts/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/services/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | apps/statefulsets/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | apps/statefulsets/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlclusters | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlclusters/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlclusters/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlogs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlogs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlogs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlsingles | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlsingles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vlsingles/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmagents | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmagents/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmagents/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagerconfigs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagerconfigs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagerconfigs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalertmanagers/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalerts | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalerts/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmalerts/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmanomalies | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmanomalies/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmanomalies/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmauths | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmauths/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmauths/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmclusters | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmclusters/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmclusters/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmnodescrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmnodescrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmnodescrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmpodscrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmprobes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmprobes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmprobes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmrules | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmrules/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmrules/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmscrapeconfigs | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmscrapeconfigs/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmscrapeconfigs/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmservicescrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmsingles | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmsingles/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmsingles/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmstaticscrapes | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmstaticscrapes/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmstaticscrapes/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmusers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmusers/finalizers | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | operator.victoriametrics.com/vmusers/status | * | High | ClusterWideAccess |
ClusterRole victoria-metrics-operator | core/events | * | Medium | ClusterWideAccess InformationDisclosure OperationalData Reconnaissance |
ClusterRole victoria-metrics-operator | policy/poddisruptionbudgets | * | Medium | AvailabilityImpact ClusterWideAccess DenialOfService Tampering |
ClusterRole victoria-metrics-operator | core/configmaps/status | get · list · watch | Low | |
ClusterRole victoria-metrics-operator | apiextensions.k8s.io/customresourcedefinitions | get · list | Low | |
ClusterRole victoria-metrics-operator | discovery.k8s.io/endpointslices | get · list · watch | Low | |
Role victoria-metrics-operator | coordination.k8s.io/leases | create · get · update | Low | |
ClusterRole victoria-metrics-operator | core/namespaces | get · list · watch | Low | ClusterStructure InformationDisclosure Reconnaissance |
ClusterRole victoria-metrics-operator | core/nodes | get · list · watch | Low | |
ClusterRole victoria-metrics-operator | core/nodes/metrics | get · list · watch | Low | |
ClusterRole victoria-metrics-operator | core/nodes/proxy | get · list · watch | Low | |
ClusterRole victoria-metrics-operator | image.openshift.io/registry/metrics | get | Low | |
ClusterRole victoria-metrics-operator | route.openshift.io/registry/metrics | get | Low | |
ClusterRole victoria-metrics-operator | image.openshift.io/routers/metrics | get | Low | |
ClusterRole victoria-metrics-operator | route.openshift.io/routers/metrics | get | Low | |
ClusterRole victoria-metrics-operator | storage.k8s.io/storageclasses | get · list · watch | Low |
⚠️ Potential Abuse (38)
The following security risks were found based on the above permissions:
- Create pods cluster-wide
- Create pods in a namespace
- Update/Patch pods cluster-wide
- Update/Patch pods in a namespace
- Read secrets cluster-wide
- Read secrets in a namespace
- Modify secrets cluster-wide
- Modify secrets in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Modify ConfigMaps cluster-wide
- Modify ConfigMaps in a namespace
- Manage ClusterRoles (create, update, patch, delete)
- Manage ClusterRoleBindings (create, update, patch, delete)
- Manage Roles in a namespace (create, update, patch, delete)
- Manage RoleBindings in a namespace (create, update, patch, delete)
- Escalate privileges via ClusterRoles (escalate verb)
- Bind ClusterRoles to identities (bind verb)
- Manage Deployments cluster-wide (potential for privileged pod execution)
- Manage Deployments in a namespace (potential for privileged pod execution)
- Manage DaemonSets cluster-wide (runs on all nodes, high impact)
- Manage DaemonSets in a namespace (runs on nodes, high impact)
- Manage StatefulSets cluster-wide
- Manage StatefulSets in a namespace
- Impersonate users, groups, or service accounts (cluster-wide)
- Manage ServiceAccounts cluster-wide
- Manage ServiceAccounts in a namespace
- Read events cluster-wide
- Manage Endpoints or EndpointSlices cluster-wide
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services cluster-wide
- Manage Services in a namespace
- Read RBAC configuration cluster-wide
- Manage PodDisruptionBudgets cluster-wide
- List Namespaces (Cluster Reconnaissance)
- Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
📦 Workloads (1)
Kind | Name | Container | Image |
---|---|---|---|
Deployment | victoria-metrics-operator | operator | victoriametrics/operator:v0.60.2 |