Permission Reference
136 entries
| Verb ⇅The Kubernetes API verb (what action is allowed). get, list, watch: read access. create, update, patch, delete: write access. bind, escalate, impersonate: privilege-specific verbs. | Resource ⇅The Kubernetes API resource targeted by the verb, e.g. pods, secrets, nodes, clusterroles. | Scope ⇅namespaced: permission applies within a single namespace only. cluster: permission applies across the entire cluster. | Tier ▲Risk tier assigned to this permission. T0: game over. Cluster-admin in zero or trivial steps, so every Secret, any node, and RBAC itself. Reading every Secret cluster-wide counts on its own, even with no RBAC takeover. Recovery means rotating credentials, not removing a binding. T1: realistic path to T0 depending on the cluster, and serious access even where that path stalls. T2: real damage (blocked evictions, poisoned templates, redirected traffic) but escalation needs uncommon preconditions. T3: read-only enumeration. Breaks nothing, but picks the next target. | Audit ⇅How much detail is written to the audit log when this action is used. None: nothing logged. Metadata: who did it and when, but not the data. Request: includes what was sent. RequestResponse: logs everything including the full response. For secrets, actual values appear in the log. | Escalation ⇅Number of known privilege escalation paths this permission enables. Click a row to expand and see the attack steps. | |
|---|---|---|---|---|---|---|
| impersonate | users | cluster | T0 | RequestResponse | 2 paths | ▼ |
| impersonate | groups | cluster | T0 | RequestResponse | 1 path | ▼ |
| impersonate | serviceaccounts | cluster | T0 | RequestResponse | 1 path | ▼ |
| escalate | clusterroles | cluster | T0 | RequestResponse | 2 paths | ▼ |
| bind | clusterroles | cluster | T0 | RequestResponse | 2 paths | ▼ |
| list | secrets | cluster | T0 | RequestResponse | 1 path | ▼ |
| watch | secrets | cluster | T0 | RequestResponse | 1 path | ▼ |
| get | nodes/proxy | cluster | T0 | RequestResponse | 3 paths | ▼ |
| create | mutatingwebhookconfigurations | cluster | T0 | RequestResponse | 1 path | ▼ |
| create | podsecuritypolicies | cluster | T0 | RequestResponse | 1 path | ▼ |
| delete | podsecuritypolicies | cluster | T0 | RequestResponse | 1 path | ▼ |
| * | * | cluster | T0 | RequestResponse | ▼ | |
| escalate | roles | namespaced | T1 | RequestResponse | 1 path | ▼ |
| bind | roles | namespaced | T1 | RequestResponse | 1 path | ▼ |
| create | clusterrolebindings | cluster | T1 | RequestResponse | 1 path | ▼ |
| create | rolebindings | namespaced | T1 | RequestResponse | 2 paths | ▼ |
| create | pods | namespaced | T1 | Request | 10 paths | ▼ |
| create | daemonsets | namespaced | T1 | RequestResponse | 1 path | ▼ |
| update | daemonsets | namespaced | T1 | Request | 1 path | ▼ |
| create | deployments | namespaced | T1 | Request | 2 paths | ▼ |
| create | statefulsets | namespaced | T1 | Request | 2 paths | ▼ |
| create | replicasets | namespaced | T1 | Request | 2 paths | ▼ |
| create | replicationcontrollers | namespaced | T1 | Request | 2 paths | ▼ |
| create | jobs | namespaced | T1 | Request | 2 paths | ▼ |
| create | cronjobs | namespaced | T1 | Request | 2 paths | ▼ |
| update | deployments | namespaced | T1 | Request | 1 path | ▼ |
| update | statefulsets | namespaced | T1 | Request | 1 path | ▼ |
| update | cronjobs | namespaced | T1 | Request | 1 path | ▼ |
| create | pods/exec | namespaced | T1 | RequestResponse | 1 path | ▼ |
| create | pods/attach | namespaced | T1 | RequestResponse | 1 path | ▼ |
| update | pods/ephemeralcontainers | namespaced | T1 | RequestResponse | 1 path | ▼ |
| patch | pods | namespaced | T1 | Request | 4 paths | ▼ |
| watch | secrets | namespaced | T1 | RequestResponse | 3 paths | ▼ |
| list | secrets | namespaced | T1 | RequestResponse | 3 paths | ▼ |
| get | secrets | namespaced | T1 | RequestResponse | 3 paths | ▼ |
| create | secrets | namespaced | T1 | RequestResponse | 2 paths | ▼ |
| create | serviceaccounts/token | namespaced | T1 | RequestResponse | 1 path | ▼ |
| create | nodes | cluster | T1 | RequestResponse | 2 paths | ▼ |
| get | pods/proxy | namespaced | T1 | Request | 1 path | ▼ |
| patch | nodes | cluster | T1 | RequestResponse | 1 path | ▼ |
| create | validatingwebhookconfigurations | cluster | T1 | RequestResponse | 1 path | ▼ |
| create | apiservices | cluster | T1 | RequestResponse | 1 path | ▼ |
| create | customresourcedefinitions | cluster | T1 | Request | 1 path | ▼ |
| create | persistentvolumes | cluster | T1 | Request | 1 path | ▼ |
| create | persistentvolumeclaims | namespaced | T1 | Request | 1 path | ▼ |
| create | namespaces | cluster | T1 | Request | 1 path | ▼ |
| patch | namespaces | cluster | T1 | Request | 1 path | ▼ |
| delete | namespaces | cluster | T1 | Request | ▼ | |
| update | configmaps | namespaced | T1 | RequestResponse | 3 paths | ▼ |
| patch | configmaps | namespaced | T1 | RequestResponse | 3 paths | ▼ |
| create | configmaps | namespaced | T1 | RequestResponse | 2 paths | ▼ |
| create | endpointslices | namespaced | T1 | Request | 1 path | ▼ |
| create | endpoints | namespaced | T1 | Request | 1 path | ▼ |
| create | ingresses | namespaced | T1 | Request | ▼ | |
| create | services | namespaced | T1 | RequestResponse | 1 path | ▼ |
| patch | services | namespaced | T1 | RequestResponse | 1 path | ▼ |
| create | mutatingadmissionpolicies | cluster | T1 | RequestResponse | 1 path | ▼ |
| patch | mutatingwebhookconfigurations | cluster | T1 | RequestResponse | 1 path | ▼ |
| create | pods/binding | namespaced | T1 | Request | 1 path | ▼ |
| patch | clusterrolebindings | cluster | T2 | RequestResponse | 1 path | ▼ |
| patch | rolebindings | namespaced | T2 | RequestResponse | 1 path | ▼ |
| create | clusterroles | cluster | T2 | RequestResponse | 2 paths | ▼ |
| update | clusterroles | cluster | T2 | RequestResponse | 2 paths | ▼ |
| create | roles | namespaced | T2 | RequestResponse | 1 path | ▼ |
| update | deployments/scale | namespaced | T2 | Request | ▼ | |
| update | replicasets | namespaced | T2 | Request | 1 path | ▼ |
| update | replicationcontrollers | namespaced | T2 | Request | 1 path | ▼ |
| delete | pods | namespaced | T2 | RequestResponse | 1 path | ▼ |
| create | pods/portforward | namespaced | T2 | Request | 1 path | ▼ |
| patch | serviceaccounts | namespaced | T2 | RequestResponse | 4 paths | ▼ |
| create | serviceaccounts | namespaced | T2 | RequestResponse | 3 paths | ▼ |
| update | pods/status | namespaced | T2 | Request | 1 path | ▼ |
| get | nodes/log | cluster | T2 | Request | 1 path | ▼ |
| delete | mutatingwebhookconfigurations | cluster | T2 | RequestResponse | 1 path | ▼ |
| delete | validatingwebhookconfigurations | cluster | T2 | RequestResponse | 1 path | ▼ |
| create | certificatesigningrequests | cluster | T2 | RequestResponse | 1 path | ▼ |
| update | certificatesigningrequests/approval | cluster | T2 | RequestResponse | 1 path | ▼ |
| approve | signers | cluster | T2 | RequestResponse | 1 path | ▼ |
| delete | customresourcedefinitions | cluster | T2 | Request | 1 path | ▼ |
| create | storageclasses | cluster | T2 | Request | 1 path | ▼ |
| get | configmaps | namespaced | T2 | Request | ▼ | |
| create | networkpolicies | namespaced | T2 | RequestResponse | 1 path | ▼ |
| delete | networkpolicies | namespaced | T2 | RequestResponse | 1 path | ▼ |
| get | services/proxy | namespaced | T2 | Request | 1 path | ▼ |
| create | tokenreviews | cluster | T2 | Request | ▼ | |
| create | subjectaccessreviews | cluster | T2 | Request | ▼ | |
| get | nodes | cluster | T2 | Metadata | 1 path | ▼ |
| list | nodes | cluster | T2 | Metadata | 1 path | ▼ |
| update | certificatesigningrequests/status | cluster | T2 | RequestResponse | ▼ | |
| sign | signers | cluster | T2 | RequestResponse | ▼ | |
| create | mutatingadmissionpolicybindings | cluster | T2 | RequestResponse | 2 paths | ▼ |
| create | validatingadmissionpolicies | cluster | T2 | RequestResponse | 1 path | ▼ |
| create | validatingadmissionpolicybindings | cluster | T2 | RequestResponse | 1 path | ▼ |
| create | clustertrustbundles | cluster | T2 | RequestResponse | 1 path | ▼ |
| patch | leases | namespaced | T2 | Request | 1 path | ▼ |
| create | priorityclasses | cluster | T2 | Request | 2 paths | ▼ |
| create | runtimeclasses | cluster | T2 | Request | 1 path | ▼ |
| patch | networkpolicies | namespaced | T2 | RequestResponse | 1 path | ▼ |
| create | deviceclasses | cluster | T2 | Request | ▼ | |
| create | poddisruptionbudgets | namespaced | T2 | Request | 1 path | ▼ |
| update | volumeattachments/status | cluster | T2 | RequestResponse | 1 path | ▼ |
| patch | storageclasses | cluster | T2 | Request | 1 path | ▼ |
| delete | deployments | namespaced | T2 | RequestResponse | ▼ | |
| delete | statefulsets | namespaced | T2 | RequestResponse | ▼ | |
| delete | daemonsets | namespaced | T2 | RequestResponse | ▼ | |
| delete | jobs | namespaced | T2 | RequestResponse | ▼ | |
| delete | cronjobs | namespaced | T2 | RequestResponse | ▼ | |
| delete | replicasets | namespaced | T2 | RequestResponse | ▼ | |
| delete | replicationcontrollers | namespaced | T2 | RequestResponse | ▼ | |
| delete | secrets | namespaced | T2 | RequestResponse | ▼ | |
| delete | configmaps | namespaced | T2 | RequestResponse | ▼ | |
| update | roles | namespaced | T2 | RequestResponse | 1 path | ▼ |
| create | horizontalpodautoscalers | namespaced | T2 | Request | 1 path | ▼ |
| create | pods/eviction | namespaced | T2 | Request | 1 path | ▼ |
| update | replicasets/scale | namespaced | T2 | Request | 1 path | ▼ |
| get | certificatesigningrequests | cluster | T3 | Metadata | 1 path | ▼ |
| create | selfsubjectaccessreviews | cluster | T3 | None | ▼ | |
| get | pods/log | namespaced | T3 | Metadata | ▼ | |
| get | pods | namespaced | T3 | Metadata | ▼ | |
| list | pods | namespaced | T3 | Metadata | ▼ | |
| list | serviceaccounts | namespaced | T3 | Metadata | ▼ | |
| list | clusterroles | cluster | T3 | Metadata | ▼ | |
| list | clusterrolebindings | cluster | T3 | Metadata | ▼ | |
| list | namespaces | cluster | T3 | Metadata | ▼ | |
| get | services | namespaced | T3 | Metadata | ▼ | |
| list | events | namespaced | T3 | None | ▼ | |
| get | volumeattachments | cluster | T3 | Metadata | ▼ | |
| patch | volumeattachments | cluster | T3 | RequestResponse | ▼ | |
| create | selfsubjectrulesreviews | cluster | T3 | Metadata | ▼ | |
| create | selfsubjectreviews | cluster | T3 | Metadata | ▼ | |
| get | nonResourceURLs:/api,/apis,/openapi*,/version | cluster | T3 | None | ▼ | |
| get | nonResourceURLs:/healthz,/livez,/readyz,/version | cluster | T3 | None | ▼ | |
| get | nonResourceURLs:/metrics | cluster | T3 | Metadata | ▼ | |
| get | nodes/metrics | cluster | T3 | Metadata | ▼ | |
| list | endpoints | cluster | T3 | Metadata | ▼ | |
| list | endpointslices | cluster | T3 | Metadata | ▼ |