kubetier

T0 is game over, in more than one way. Cluster-admin can mean every Secret in every namespace, code on any node, or RBAC rewritten to keep the access. Some of it is reversible: a compromised worker node gets rebuilt and the grant revoked. Most of it is not. Credentials that were read stay valid until each one is rotated, and anyone who reached the cluster CA can issue client certificates that keep working until the CA itself is rotated.

T1 is one step from T0, or already serious on its own. Whether it reaches cluster-admin depends on the cluster: PodSecurity settings, whether a privileged ServiceAccount sits in the same namespace, whether control-plane nodes accept workloads. Assume it does. Where it does not, T1 still reads every Secret in the namespace, or runs code in an existing pod and uses that pod's ServiceAccount token.

T2 does real damage without reaching cluster-admin. Workloads that resist removal, such as a PodDisruptionBudget that makes drain fail or a toleration that gets around node quarantine. A poisoned workload template that runs on the next scale-up. Volumes that outlive the namespace that owned them. Traffic redirected away from a Service, or another namespace's pods evicted. Escalation needs preconditions most clusters do not have, so the blast radius stays namespaced or depends on a specific add-on.

T3 is what an attacker reads first. Enumeration tells them which ServiceAccounts are privileged and where to aim the next request. Nothing breaks, but the path gets shorter.

Tiers below T0 come with conditions. Where a T1 or T2 grant does reach cluster-admin alongside the right other grants, the entry carries a Contextual upgrade to T0, so check it against the rest of the role before you treat the tier as the whole answer.