← Permission ReferenceK8s docs ↗ K8s docs ↗
T1
create customresourcedefinitions
A CustomResourceDefinition with a conversion webhook routes every read and write of that resource type to your endpoint, capturing all traffic for it.
- API Group
- apiextensions.k8s.io
- Scope
- cluster
- Audit Level
- Request
Escalation Paths
Create a CRD that registers a conversion webhook pointing at an attacker-controlled server.
Reads or writes that require version conversion are routed through the webhook, which can read and rewrite those objects in flight.
The API server requires a CA bundle and TLS, so this needs a serving certificate the API server will accept.
Additional rights needed:
none