drd-vpc-agent

The agent requires significant Kubernetes permissions, including extensive read access across various resources. When the optional Network Mapper is enabled (default behavior in Kubernetes deployments), it deploys a sniffer DaemonSet that runs with `hostNetwork: true` and requests `SYS_PTRACE`, `NET_RAW` capabilities, granting highly privileged access to node network traffic. The auto-update feature, enabled by default in Kubernetes, grants write (`get`, `patch`, `update`) access to `deployments` resources within the agent's namespace, which could be a risk if the update mechanism or cronjob is compromised. The use of `eval` in deployment scripts (`deploy_k8s.sh`) is noted, though appears contained to trusted local scripts. While these permissions are justified for the agent's monitoring and network mapping functionality, they introduce a broad attack surface and require careful security review and trust in the upstream images and update process.