patch clusterrolebindings

Patching in new subjects hits the same escalation prevention check as create.

It requires bind on the referenced ClusterRole, or already holding all its permissions.

roleRef is immutable, so an existing binding cannot be repointed at a more privileged ClusterRole, only deleted and recreated.

This is not an independent bypass.

Escalation Paths

Patch the subjects array of an existing ClusterRoleBinding
Kubernetes applies the same escalation check as CREATE, requiring bind on the referenced ClusterRole or already holding all its permissions
Useful for maintenance if you already hold bind.
It is not an independent bypass of the escalation check

Additional rights needed:

none