High-risk tools in Local Ydb
9 of the 39 tools in Local Ydb are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
local_ydb_add_dynamic_nodesExecuteAdd one-off dynamic tenant nodes beyond the declarative profile.dynamicNodeCount topology, one at a time. By default the first suffix is dynamicNodeCount + 1; an explicit startI...
-
local_ydb_apply_auth_hardeningExecuteApply a reviewed hardened YDB config file only after a full check-only static profile and configured-binding compatibility preflight succeeds before any config or container muta...
-
local_ydb_bootstrapExecuteBootstrap a tenant topology: static node with GraphShard flags and loopback bindings for static plus every configured dynamic gRPC port, configured CMS tenant, and all dynamic n...
-
local_ydb_bootstrap_root_databaseExecuteBootstrap a plain local YDB database at /local with only a static node. Use for generic local database requests that do not need a CMS tenant, GraphShard, or dynamic nodes; an e...
-
local_ydb_pull_imageExecutePlan or start a background Docker pull for a local-ydb image on the selected target. Without confirm=true it returns inspect and pull commands only; with confirm=true it returns...
-
local_ydb_restart_stackExecuteReconcile and restart the selected profile after inventory and a full check-only static compatibility preflight. Before stopping any container, require the existing static conta...
-
local_ydb_sqlExecuteRun managed YQL v1 against the configured local-ydb target through Query Service. query uses SnapshotRO, explain returns plan/AST, and execute always runs EXPLAIN first and send...
-
local_ydb_start_dynamic_nodeExecuteStart the configured primary dynamic tenant node for an existing CMS tenant. Before returning or executing a plan, it rejects a primary name that aliases the static container an...
-
local_ydb_upgrade_versionExecuteUpgrade a file-backed, volume-backed local-ydb profile to a target image tag. Use only for version upgrades on profiles without bindMountPath; before dump or destroy it inspects...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.