create rolebindings
Alone, escalation prevention only permits binding roles whose permissions you already hold.
With bind on the referenced Role or ClusterRole, this grants full namespace control.
In kube-system, the impact can reach T0.
T0 with following verbs:
Namespace-scoped rights over a namespace holding cluster-privileged credentials
scoped to kube-system, or any namespace holding a cluster-privileged ServiceAccount
bind on clusterroles waives escalation prevention, so a RoleBinding can reference cluster-admin without the caller holding it.
Scoped to one namespace, this still reaches the controller credentials that live in kube-system.
- API Group
- rbac.authorization.k8s.io
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Use escalate on roles to bypass the check that normally prevents writing permissions you do not already hold.
Create or update a Role granting arbitrary permissions in the namespace.
Activate it with a RoleBinding.
Creating or changing the binding still needs bind on the referenced Role, or the caller must already hold the referenced permissions.
Additional rights needed:
· all four; escalate writes the rules, bind permits referencing them
· editing an existing Role instead of creating one
A RoleBinding can reference a ClusterRole.
This is valid RBAC.
The ClusterRole's permissions are scoped to the RoleBinding's namespace.
Cluster-scoped resources remain inaccessible.
bind on clusterroles bypasses the escalation check.
Create a RoleBinding to cluster-admin or any ClusterRole you don't fully hold.
Full control over namespace-scoped resources in that namespace, but cluster-scoped resources remain blocked.
This reaches T0 in kube-system via controller SA tokens and Secrets.
Additional rights needed:
· both; the RoleBinding may reference a ClusterRole
Note:
kubectl auth can-i falsely returns yes for cluster-scoped resources when bound via a RoleBinding to a wildcard ClusterRole (SubjectAccessReview quirk).
Actual requests are correctly denied.
A create or patch on nodes returns Forbidden.