Read/write access to most namespaced resources.
Can deploy workloads, exec/attach where included by aggregation, read/write secrets, and run Pods as any ServiceAccount in the namespace.
Lacks RBAC role/rolebinding management.
- →
Can read secrets and run Pods as any ServiceAccount in the namespace, so treat it as T1 despite the friendly name.
- →
Aggregation rule: ClusterRoles labeled 'rbac.authorization.k8s.io/aggregate-to-edit: "true"' are automatically merged in.
- →
Cannot manage Roles/RoleBindings by default, but workload creation and ServiceAccount token access are sufficient for many attack paths.
- →
In clusters created with Kubernetes v1.22+, default aggregated edit no longer includes broad Endpoints write access.
- →
Holds impersonate on serviceaccounts and create on serviceaccounts/token: in a namespace hosting a cluster-privileged ServiceAccount, or on a cluster without PodSecurity restricted, this reaches cluster-admin (contextual T0).
Permissions (27)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "" | pods/attach, pods/exec, pods/portforward, pods/proxy, secrets, services/proxy | get list watch |
| "" | serviceaccounts | impersonate |
| "" | pods, pods/attach, pods/exec, pods/portforward, pods/proxy | create delete deletecollection patch update |
| "" | pods/eviction | create |
| "" | configmaps, persistentvolumeclaims, replicationcontrollers, replicationcontrollers/scale, secrets, serviceaccounts, services, services/proxy | create delete deletecollection patch update |
| "" | serviceaccounts/token | create |
| "", events.k8s.io | events | create delete deletecollection patch update |
| apps | daemonsets, deployments, deployments/rollback, deployments/scale, replicasets, replicasets/scale, statefulsets, statefulsets/scale | create delete deletecollection patch update |
| autoscaling | horizontalpodautoscalers | create delete deletecollection patch update |
| batch | cronjobs, jobs | create delete deletecollection patch update |
| extensions | daemonsets, deployments, deployments/rollback, deployments/scale, ingresses, networkpolicies, replicasets, replicasets/scale, replicationcontrollers/scale | create delete deletecollection patch update |
| policy | poddisruptionbudgets | create delete deletecollection patch update |
| networking.k8s.io | ingresses, networkpolicies | create delete deletecollection patch update |
| coordination.k8s.io | leases | create delete deletecollection get list patch update watch |
| resource.k8s.io | resourceclaims, resourceclaimtemplates | create delete deletecollection patch update |
| "" | configmaps, endpoints, persistentvolumeclaims, persistentvolumeclaims/status, pods, replicationcontrollers, replicationcontrollers/scale, serviceaccounts, services, services/status | get list watch |
| "" | bindings, limitranges, namespaces/status, pods/log, pods/status, replicationcontrollers/status, resourcequotas, resourcequotas/status | get list watch |
| "" | namespaces | get list watch |
| "", events.k8s.io | events | get list watch |
| discovery.k8s.io | endpointslices | get list watch |
| apps | controllerrevisions, daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, replicasets, replicasets/scale, replicasets/status, statefulsets, statefulsets/scale, statefulsets/status | get list watch |
| autoscaling | horizontalpodautoscalers, horizontalpodautoscalers/status | get list watch |
| batch | cronjobs, cronjobs/status, jobs, jobs/status | get list watch |
| extensions | daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, ingresses, ingresses/status, networkpolicies, replicasets, replicasets/scale, replicasets/status, replicationcontrollers/scale | get list watch |
| policy | poddisruptionbudgets, poddisruptionbudgets/status | get list watch |
| networking.k8s.io | ingresses, ingresses/status, networkpolicies | get list watch |
| resource.k8s.io | resourceclaims, resourceclaims/status, resourceclaimtemplates | get list watch |