bind clusterroles
Removes the safeguard against binding a ClusterRole with permissions you don't hold.
Combined with create or update on ClusterRoleBindings, or RoleBindings that reference a ClusterRole, this grants cluster-admin-equivalent access.
- API Group
- rbac.authorization.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
The bind verb bypasses escalation prevention on ClusterRoleBindings
Create a ClusterRoleBinding from cluster-admin to your own identity
You now hold cluster-admin
Additional rights needed:
· both; bind waives the check, create makes the binding
Note:
By design, holding bind on clusterrolebindings intentionally allows self-binding to cluster-admin.
No patch exists.
A RoleBinding can reference a ClusterRole.
This is valid RBAC.
The ClusterRole's permissions are scoped to the RoleBinding's namespace.
Cluster-scoped resources remain inaccessible.
bind on clusterroles bypasses the escalation check.
Create a RoleBinding to cluster-admin or any ClusterRole you don't fully hold.
Full control over namespace-scoped resources in that namespace, but cluster-scoped resources remain blocked.
This reaches T0 in kube-system via controller SA tokens and Secrets.
Additional rights needed:
· both; the RoleBinding may reference a ClusterRole
Note:
kubectl auth can-i falsely returns yes for cluster-scoped resources when bound via a RoleBinding to a wildcard ClusterRole (SubjectAccessReview quirk).
Actual requests are correctly denied.
A create or patch on nodes returns Forbidden.