create clusterroles
Escalation prevention alone limits a new ClusterRole's rules to permissions you already hold, making this T2.
With escalate, it becomes T0.
You can write any rules and inject them cluster-wide via aggregation labels (aggregate-to-admin/edit/view), or patch a role already bound to you directly.
T0 with following verbs:
Arbitrary cluster-wide rules, including rules the caller does not hold
A ClusterRole may normally only contain rules the caller already holds.
escalate on clusterroles removes that restriction, so any rule can be written, including wildcard access, and then bound.
- API Group
- rbac.authorization.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Use the escalate verb to bypass privilege-escalation prevention
Patch own bound ClusterRole to add */* rules (must be a role already bound to you)
Permissions expand via the existing binding.
No bind is needed when patching an already-bound ClusterRole.
Creating a new role and self-binding it requires bind clusterroles separately
Additional rights needed:
· escalate plus a way to write the rules
· editing an already-bound role needs no new binding
Note:
This is a by-design capability, not a CVE.
The escalate verb bypasses privilege-escalation prevention, so any identity holding it can grant permissions it does not already have.
No patch exists.
Create or update a ClusterRole with an aggregation label such as rbac.authorization.k8s.io/aggregate-to-admin: true.
The ClusterRole aggregation controller merges its rules into the built-in admin/edit/view role.
Prevention applies at write time.
Without escalate, only rules the caller holds can be injected.
With escalate, any rules can be injected regardless of caller permissions.
All principals bound to the role gain injected permissions.
T0 only where admin/edit is cluster-bound or the namespace holds cluster-admin credentials.
Additional rights needed:
· escalate plus a way to write the labelled role
· relabelling an existing role also works
Note:
Escalation prevention blocks injection of rules the caller does not hold, even with an aggregate-to-admin label.
The escalate verb is required to inject arbitrary rules.
Without it, only rules the caller already possesses can be aggregated.