Create or update a ClusterRole with an aggregation label such as rbac.authorization.k8s.io/aggregate-to-admin: true.
The ClusterRole aggregation controller merges its rules into the built-in admin/edit/view role.
Prevention applies at write time.
Without escalate, only rules the caller holds can be injected.
With escalate, any rules can be injected regardless of caller permissions.
All principals bound to the role gain injected permissions.
T0 only where admin/edit is cluster-bound or the namespace holds cluster-admin credentials.
Rights needed, any one set:
· escalate plus a way to write the labelled role
· relabelling an existing role also works
Note:
Escalation prevention blocks injection of rules the caller does not hold, even with an aggregate-to-admin label.
The escalate verb is required to inject arbitrary rules.
Without it, only rules the caller already possesses can be aggregated.