Rights needed:

• T0bind clusterroles+T1create clusterrolebindings

  · both; bind waives the check, create makes the binding

Note:

By design, holding bind on clusterrolebindings intentionally allows self-binding to cluster-admin.

No patch exists.