velero

Description

A Helm chart for velero

• https://github.com/vmware-tanzu/velero

Overview

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

🤖 velero-server

Namespace: default  |  Automount: ❌

🔑 Permissions (1)

⚠️ Potential Abuse (39)

The following security risks were found based on the above permissions:

• Namespaced pod exec
• Namespaced pod attach
• Namespaced pod port-forward
• Create pods in a namespace
• Update/Patch pods in a namespace
• Read secrets in a namespace
• Modify secrets in a namespace
• Read pod logs in a namespace
• Manage ephemeral containers in a namespace
• Read ConfigMaps in a namespace
• Modify ConfigMaps in a namespace
• Manage Roles in a namespace (create, update, patch, delete)
• Manage RoleBindings in a namespace (create, update, patch, delete)
• Manage Deployments in a namespace (potential for privileged pod execution)
• Manage DaemonSets in a namespace (runs on nodes, high impact)
• Manage StatefulSets in a namespace
• Manage CronJobs in a namespace (scheduled privileged execution, persistence)
• Manage Jobs in a namespace (one-off privileged execution)
• Create ServiceAccount Tokens
• Create LocalSubjectAccessReviews (check permissions in a namespace)
• Evict Pods in a namespace
• Wildcard permission on all resources in a namespace (Namespace Admin)
• Manage ArgoCD Applications (argoproj.io)
• Manage ServiceAccounts in a namespace
• Manage NetworkPolicies in a namespace
• Manage Endpoints or EndpointSlices in a namespace
• Manage Services in a namespace
• Manage Leases in kube-system or kube-node-lease namespace
• Create/Update ControllerRevisions (Potential Tampering)
• Create SelfSubjectRulesReviews (Discover Own Permissions)
• Read LimitRanges (Namespace Information Disclosure)
• Read ResourceQuotas (Namespace Information Disclosure)
• Manage Ingresses (Namespace Service Exposure/Traffic Redirection)
• Update PodDisruptionBudget Status (Namespace Tampering/DoS)
• Update Deployment Scale (Resource Abuse/DoS)
• Update StatefulSet Scale (Resource Abuse/DoS)
• Read CSIStorageCapacities (Namespace Storage Reconnaissance)
• Watch All Resources in a Namespace (Broad Information Disclosure)

📦 Workloads (1)