bind roles

Removes the safeguard against binding a namespaced Role with permissions you don't hold.

Binding a ClusterRole such as cluster-admin through a RoleBinding still requires bind on clusterroles, not bind on roles.

Escalation Paths

Use escalate on roles to bypass the check that normally prevents writing permissions you do not already hold.
Create or update a Role granting arbitrary permissions in the namespace.
Activate it with a RoleBinding.
Creating or changing the binding still needs bind on the referenced Role, or the caller must already hold the referenced permissions.

Additional rights needed:

T1escalate roles+T2create roles+T1create rolebindings
· all four; escalate writes the rules, bind permits referencing them
orT1escalate roles+T2update roles+T1create rolebindings
· editing an existing Role instead of creating one