← Permission ReferenceK8s docs ↗
T0
impersonate serviceaccounts
Authenticate as any ServiceAccount via system:serviceaccount:<namespace>:<name>.
T0 when the target is a kube-system or controller ServiceAccount with cluster-admin-equivalent rights.
In v1.36+, constrained impersonation can scope new-style grants, but legacy impersonate rules still work.
- API Group
- (core)
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Impersonate system:serviceaccount:kube-system:clusterrole-aggregation-controller
That SA has escalate on all ClusterRoles by default
Patch own bound ClusterRole to inject */* rules via impersonation
Additional rights needed:
none