Namespace administrator with read/write access to most namespaced resources, including Roles and RoleBindings.
Still constrained by RBAC privilege-escalation prevention unless explicit bind/escalate is also granted.
- →
Can create Roles/RoleBindings in the namespace, but cannot grant permissions it does not already hold unless explicit bind/escalate permissions are present.
- →
Can read/write secrets and run workloads as any ServiceAccount in the namespace, making it T1 in normal namespaces and potentially T0 in kube-system.
- →
Aggregation rule: ClusterRoles labeled 'rbac.authorization.k8s.io/aggregate-to-admin: "true"' are automatically merged in.
- →
In clusters created with Kubernetes v1.22+, default aggregated admin/edit no longer include broad Endpoints write access because of CVE-2021-25740; upgraded clusters may retain legacy grants.
- →
Holds impersonate on serviceaccounts and create on serviceaccounts/token: in a namespace hosting a cluster-privileged ServiceAccount, or on a cluster without PodSecurity restricted, this reaches cluster-admin (contextual T0).
Permissions (29)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "" | pods/attach, pods/exec, pods/portforward, pods/proxy, secrets, services/proxy | get list watch |
| "" | serviceaccounts | impersonate |
| "" | pods, pods/attach, pods/exec, pods/portforward, pods/proxy | create delete deletecollection patch update |
| "" | pods/eviction | create |
| "" | configmaps, persistentvolumeclaims, replicationcontrollers, replicationcontrollers/scale, secrets, serviceaccounts, services, services/proxy | create delete deletecollection patch update |
| "" | serviceaccounts/token | create |
| "", events.k8s.io | events | create delete deletecollection patch update |
| apps | daemonsets, deployments, deployments/rollback, deployments/scale, replicasets, replicasets/scale, statefulsets, statefulsets/scale | create delete deletecollection patch update |
| autoscaling | horizontalpodautoscalers | create delete deletecollection patch update |
| batch | cronjobs, jobs | create delete deletecollection patch update |
| extensions | daemonsets, deployments, deployments/rollback, deployments/scale, ingresses, networkpolicies, replicasets, replicasets/scale, replicationcontrollers/scale | create delete deletecollection patch update |
| policy | poddisruptionbudgets | create delete deletecollection patch update |
| networking.k8s.io | ingresses, networkpolicies | create delete deletecollection patch update |
| coordination.k8s.io | leases | create delete deletecollection get list patch update watch |
| resource.k8s.io | resourceclaims, resourceclaimtemplates | create delete deletecollection patch update |
| "" | configmaps, endpoints, persistentvolumeclaims, persistentvolumeclaims/status, pods, replicationcontrollers, replicationcontrollers/scale, serviceaccounts, services, services/status | get list watch |
| "" | bindings, limitranges, namespaces/status, pods/log, pods/status, replicationcontrollers/status, resourcequotas, resourcequotas/status | get list watch |
| "" | namespaces | get list watch |
| "", events.k8s.io | events | get list watch |
| discovery.k8s.io | endpointslices | get list watch |
| apps | controllerrevisions, daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, replicasets, replicasets/scale, replicasets/status, statefulsets, statefulsets/scale, statefulsets/status | get list watch |
| autoscaling | horizontalpodautoscalers, horizontalpodautoscalers/status | get list watch |
| batch | cronjobs, cronjobs/status, jobs, jobs/status | get list watch |
| extensions | daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, ingresses, ingresses/status, networkpolicies, replicasets, replicasets/scale, replicasets/status, replicationcontrollers/scale | get list watch |
| policy | poddisruptionbudgets, poddisruptionbudgets/status | get list watch |
| networking.k8s.io | ingresses, ingresses/status, networkpolicies | get list watch |
| resource.k8s.io | resourceclaims, resourceclaims/status, resourceclaimtemplates | get list watch |
| authorization.k8s.io | localsubjectaccessreviews | create |
| rbac.authorization.k8s.io | rolebindings, roles | create delete deletecollection get list patch update watch |