Kubetier
← Permission Reference
T0

impersonate users

Authenticate as any user named in the Impersonate-User header, once the API server confirms the caller holds impersonate rights on that identity.

Impersonating a cluster-admin-equivalent user is immediate T0.

API Group
(core)
Scope
cluster
Audit Level
RequestResponse

Escalation Paths

T0Impersonate any user

  1. Send Impersonate-User: cluster-admin header to the API server

  2. API server evaluates all RBAC as the impersonated user

  3. Read all secrets or perform any cluster-admin action

Additional rights needed:

none
K8s docs ↗
T0Impersonate system:masters group

  1. Send Impersonate-User together with Impersonate-Group: system:masters.

    Kubernetes rejects group impersonation without an impersonated user.

  2. The API server authorizes the request as a member of system:masters, a built-in group with unrestricted API-server access that bypasses RBAC/Webhook restrictions.

  3. Perform any cluster-wide action.

Additional rights needed:

Note:

In v1.36+, constrained impersonation may require action-scoped permissions for new-style grants, but legacy impersonate RBAC rules still work.

Mitigation is to remove the RBAC grant, fix IdP/IAM mapping, or rotate the CA only if the source is a leaked non-revokable system:masters client certificate.

K8s docs ↗
K8s docs ↗