Kubernetes authorises actions as verbs (get, list, create, update) on resources (pods, secrets, roles). RBAC is meant to prevent an identity from granting itself more than it has, but several specific permissions break that containment. Holding any one of them turns a limited service account into a path to cluster admin: a role that is too broad, the escalate or bind verbs that defeat the anti-escalation check, impersonate to become another identity, certificate signing to mint a privileged client cert, the TokenRequest API to mint other service accounts' tokens, or the ability to create pods and schedule a node-owning one.
Map the identity's permissions first:
kubectl auth can-i --list # the full rule set for this identity
# flag the dangerous ones:
kubectl auth can-i create pods --all-namespaces
kubectl auth can-i get secrets --all-namespaces
kubectl auth can-i impersonate users
kubectl auth can-i create clusterrolebindings
kubectl auth can-i '*' '*'
Subtopics#
- Over-permissive roles: wildcard or secret-reading roles.
- Escalate and bind verbs: granting yourself more than you hold.
- Impersonation: acting as another user, group, or service account.
- CSR approval: minting a privileged client certificate.
- TokenRequest API: minting tokens for other service accounts.
- Service account token abuse: mounting or reusing powerful tokens.
- Pod creation to node: scheduling a pod that owns its node.