get certificatesigningrequests

Reading a CertificateSigningRequest returns its status, including the issued certificate once a signer has populated it.

This is the retrieval step of certificate minting.

Without a read verb, a successfully issued certificate stays out of reach.

T0 with following verbs:

Authenticate to the API server as any user, in any group

scoped to signerName kubernetes.io/kube-apiserver-client

Completes the chain: submit, approve, then collect the signed certificate.

Every step is a separate RBAC grant and all four are needed.

Escalation Paths

Enumerate User subjects already bound to cluster-admin or other high-privilege ClusterRoles via kubectl get clusterrolebinding.
Create a CSR using a CN matching one of those usernames and request the kubernetes.io/kube-apiserver-client signer.
Approve the CSR.
This requires both update on certificatesigningrequests/approval and approve on signers for that exact signerName.
The built-in signing controller issues a real, CA-signed certificate automatically.
No CA key or extra access is needed from the caller.
The cert authenticates as the matched username, inheriting all its RBAC permissions.
It works until expiry.
Individual revocation requires CA rotation.

Additional rights needed:

Note:

The CSR API remains dangerous for kube-apiserver client certificates, but the direct built-in system:masters request is rejected by signer policy.

Custom signers or certificates for other bound high-privilege identities can still be escalation paths.