Kubetier
T1Bind high-privilege ClusterRole into a namespace via RoleBinding

  1. A RoleBinding can reference a ClusterRole.

    This is valid RBAC.

    The ClusterRole's permissions are scoped to the RoleBinding's namespace.

    Cluster-scoped resources remain inaccessible.

  2. bind on clusterroles bypasses the escalation check.

    Create a RoleBinding to cluster-admin or any ClusterRole you don't fully hold.

  3. Full control over namespace-scoped resources in that namespace, but cluster-scoped resources remain blocked.

    This reaches T0 in kube-system via controller SA tokens and Secrets.

Rights needed:

Note:

kubectl auth can-i falsely returns yes for cluster-scoped resources when bound via a RoleBinding to a wildcard ClusterRole (SubjectAccessReview quirk).

Actual requests are correctly denied.

A create or patch on nodes returns Forbidden.

K8s docs ↗