Permission Reference

143 entries

Verb ⇅The Kubernetes API verb (what action is allowed). get, list, watch: read access. create, update, patch, delete: write access. bind, escalate, impersonate: privilege-specific verbs.	Resource ⇅The Kubernetes API resource targeted by the verb, e.g. pods, secrets, nodes, clusterroles.	Scope ⇅namespaced: permission applies within a single namespace only. cluster: permission applies across the entire cluster.	Tier ▲Risk tier assigned to this permission. T0: game over, in more than one way. Cluster-admin in zero or trivial steps: every Secret, any node, or RBAC itself. A compromised node can be rebuilt; exposed credentials and a reached cluster CA only recover by rotation. T1: realistic path to T0 depending on the cluster, and serious access even where that path stalls. T2: real damage (blocked evictions, poisoned templates, redirected traffic) but escalation needs uncommon preconditions. T3: read-only enumeration. Breaks nothing, but picks the next target.	Audit ⇅How much detail is written to the audit log when this action is used. None: nothing logged. Metadata: who did it and when, but not the data. Request: includes what was sent. RequestResponse: logs everything including the full response. For secrets, actual values appear in the log.	Escalation ⇅Number of known privilege escalation paths this permission enables. Click a row to expand and see the attack steps.
impersonate	users	cluster	T0	RequestResponse	2 paths	▼
impersonate	groups	cluster	T0	RequestResponse	1 path	▼
impersonate	serviceaccounts	cluster	T0	RequestResponse	1 path	▼
escalate	clusterroles	cluster	T0	RequestResponse	2 paths	▼
bind	clusterroles	cluster	T0	RequestResponse	2 paths	▼
list	secrets	cluster	T0	RequestResponse	1 path	▼
watch	secrets	cluster	T0	RequestResponse	1 path	▼
get	nodes/proxy	cluster	T0	RequestResponse	3 paths	▼
create	mutatingwebhookconfigurations	cluster	T0	RequestResponse	1 path	▼
*	*	cluster	T0	RequestResponse		▼
escalate	roles	namespaced	T1	RequestResponse	1 path	▼
bind	roles	namespaced	T1	RequestResponse	1 path	▼
create	clusterrolebindings	cluster	T1	RequestResponse	1 path	▼
create	rolebindings	namespaced	T1	RequestResponse	2 paths	▼
create	pods	namespaced	T1	Request	14 paths	▼
create	daemonsets	namespaced	T1	RequestResponse	1 path	▼
update	daemonsets	namespaced	T1	Request	1 path	▼
patch	daemonsets	namespaced	T1	Request	1 path	▼
create	deployments	namespaced	T1	Request	2 paths	▼
create	statefulsets	namespaced	T1	Request	2 paths	▼
create	replicasets	namespaced	T1	Request	2 paths	▼
create	replicationcontrollers	namespaced	T1	Request	2 paths	▼
create	jobs	namespaced	T1	Request	2 paths	▼
create	cronjobs	namespaced	T1	Request	2 paths	▼
update	deployments	namespaced	T1	Request	1 path	▼
patch	deployments	namespaced	T1	Request	1 path	▼
update	statefulsets	namespaced	T1	Request	1 path	▼
patch	statefulsets	namespaced	T1	Request	1 path	▼
update	cronjobs	namespaced	T1	Request	1 path	▼
patch	cronjobs	namespaced	T1	Request	1 path	▼
create	pods/exec	namespaced	T1	RequestResponse	1 path	▼
create	pods/attach	namespaced	T1	RequestResponse	1 path	▼
update	pods/ephemeralcontainers	namespaced	T1	RequestResponse	1 path	▼
patch	pods	namespaced	T1	Request	4 paths	▼
watch	secrets	namespaced	T1	RequestResponse	3 paths	▼
list	secrets	namespaced	T1	RequestResponse	3 paths	▼
get	secrets	namespaced	T1	RequestResponse	3 paths	▼
patch	secrets	namespaced	T1	RequestResponse		▼
update	secrets	namespaced	T1	RequestResponse		▼
create	secrets	namespaced	T1	RequestResponse	2 paths	▼
create	serviceaccounts/token	namespaced	T1	RequestResponse	3 paths	▼
create	nodes	cluster	T1	RequestResponse	2 paths	▼
get	pods/proxy	namespaced	T1	Request	1 path	▼
patch	nodes	cluster	T1	RequestResponse	1 path	▼
create	validatingwebhookconfigurations	cluster	T1	RequestResponse	1 path	▼
patch	validatingwebhookconfigurations	cluster	T1	RequestResponse	2 paths	▼
create	apiservices	cluster	T1	RequestResponse	1 path	▼
create	customresourcedefinitions	cluster	T1	Request	1 path	▼
create	persistentvolumes	cluster	T1	Request	1 path	▼
create	persistentvolumeclaims	namespaced	T1	Request	1 path	▼
create	namespaces	cluster	T1	Request	1 path	▼
patch	namespaces	cluster	T1	Request	1 path	▼
delete	namespaces	cluster	T1	Request		▼
update	configmaps	namespaced	T1	RequestResponse	3 paths	▼
patch	configmaps	namespaced	T1	RequestResponse	3 paths	▼
create	configmaps	namespaced	T1	RequestResponse	2 paths	▼
create	endpointslices	namespaced	T1	Request	1 path	▼
create	endpoints	namespaced	T1	Request	1 path	▼
create	ingresses	namespaced	T1	Request		▼
create	services	namespaced	T1	RequestResponse	1 path	▼
patch	services	namespaced	T1	RequestResponse	1 path	▼
create	mutatingadmissionpolicies	cluster	T1	RequestResponse	1 path	▼
patch	mutatingwebhookconfigurations	cluster	T1	RequestResponse	1 path	▼
create	pods/binding	namespaced	T1	Request	1 path	▼
patch	clusterrolebindings	cluster	T2	RequestResponse	1 path	▼
patch	rolebindings	namespaced	T2	RequestResponse	1 path	▼
create	clusterroles	cluster	T2	RequestResponse	2 paths	▼
update	clusterroles	cluster	T2	RequestResponse	2 paths	▼
create	roles	namespaced	T2	RequestResponse	1 path	▼
update	deployments/scale	namespaced	T2	Request		▼
update	replicasets	namespaced	T2	Request	1 path	▼
patch	replicasets	namespaced	T2	Request	1 path	▼
update	replicationcontrollers	namespaced	T2	Request	1 path	▼
patch	replicationcontrollers	namespaced	T2	Request	1 path	▼
delete	pods	namespaced	T2	RequestResponse	1 path	▼
create	pods/portforward	namespaced	T2	Request	1 path	▼
patch	serviceaccounts	namespaced	T2	RequestResponse	3 paths	▼
create	serviceaccounts	namespaced	T2	RequestResponse	4 paths	▼
update	pods/status	namespaced	T2	Request	1 path	▼
get	nodes/log	cluster	T2	Request	1 path	▼
delete	mutatingwebhookconfigurations	cluster	T2	RequestResponse	1 path	▼
delete	validatingwebhookconfigurations	cluster	T2	RequestResponse	1 path	▼
create	certificatesigningrequests	cluster	T2	RequestResponse	2 paths	▼
update	certificatesigningrequests/approval	cluster	T2	RequestResponse	2 paths	▼
approve	signers	cluster	T2	RequestResponse	2 paths	▼
delete	customresourcedefinitions	cluster	T2	Request	1 path	▼
create	storageclasses	cluster	T2	Request	1 path	▼
get	configmaps	namespaced	T2	Request		▼
create	networkpolicies	namespaced	T2	RequestResponse	1 path	▼
delete	networkpolicies	namespaced	T2	RequestResponse	1 path	▼
get	services/proxy	namespaced	T2	Request	1 path	▼
create	tokenreviews	cluster	T2	Request		▼
create	subjectaccessreviews	cluster	T2	Request		▼
get	nodes	cluster	T2	Metadata	1 path	▼
list	nodes	cluster	T2	Metadata	1 path	▼
update	certificatesigningrequests/status	cluster	T2	RequestResponse		▼
sign	signers	cluster	T2	RequestResponse		▼
create	mutatingadmissionpolicybindings	cluster	T2	RequestResponse	2 paths	▼
create	validatingadmissionpolicies	cluster	T2	RequestResponse	1 path	▼
create	validatingadmissionpolicybindings	cluster	T2	RequestResponse	1 path	▼
create	clustertrustbundles	cluster	T2	RequestResponse	1 path	▼
patch	leases	namespaced	T2	Request	1 path	▼
create	priorityclasses	cluster	T2	Request	2 paths	▼
create	runtimeclasses	cluster	T2	Request	1 path	▼
patch	networkpolicies	namespaced	T2	RequestResponse	1 path	▼
create	deviceclasses	cluster	T2	Request		▼
create	poddisruptionbudgets	namespaced	T2	Request	1 path	▼
update	volumeattachments/status	cluster	T2	RequestResponse	1 path	▼
patch	storageclasses	cluster	T2	Request	1 path	▼
delete	deployments	namespaced	T2	RequestResponse		▼
delete	statefulsets	namespaced	T2	RequestResponse		▼
delete	daemonsets	namespaced	T2	RequestResponse		▼
delete	jobs	namespaced	T2	RequestResponse		▼
delete	cronjobs	namespaced	T2	RequestResponse		▼
delete	replicasets	namespaced	T2	RequestResponse		▼
delete	replicationcontrollers	namespaced	T2	RequestResponse		▼
delete	secrets	namespaced	T2	RequestResponse		▼
delete	configmaps	namespaced	T2	RequestResponse	1 path	▼
update	roles	namespaced	T2	RequestResponse	1 path	▼
create	horizontalpodautoscalers	namespaced	T2	Request	1 path	▼
create	pods/eviction	namespaced	T2	Request	1 path	▼
update	replicasets/scale	namespaced	T2	Request		▼
get	certificatesigningrequests	cluster	T3	Metadata	2 paths	▼
create	selfsubjectaccessreviews	cluster	T3	None		▼
get	pods/log	namespaced	T3	Metadata		▼
get	pods	namespaced	T3	Metadata		▼
list	pods	namespaced	T3	Metadata		▼
list	serviceaccounts	namespaced	T3	Metadata		▼
list	clusterroles	cluster	T3	Metadata		▼
list	clusterrolebindings	cluster	T3	Metadata		▼
list	namespaces	cluster	T3	Metadata		▼
get	services	namespaced	T3	Metadata		▼
list	events	namespaced	T3	None		▼
get	volumeattachments	cluster	T3	Metadata		▼
patch	volumeattachments	cluster	T3	RequestResponse		▼
create	selfsubjectrulesreviews	cluster	T3	Metadata		▼
create	selfsubjectreviews	cluster	T3	Metadata		▼
get	nonResourceURLs:/api,/apis,/openapi*,/version	cluster	T3	None		▼
get	nonResourceURLs:/healthz,/livez,/readyz,/version	cluster	T3	None		▼
get	nonResourceURLs:/metrics	cluster	T3	Metadata		▼
get	nodes/metrics	cluster	T3	Metadata		▼
list	endpoints	cluster	T3	Metadata		▼
list	endpointslices	cluster	T3	Metadata		▼