create roles
Rules on a new Role are limited to permissions you already hold, unless the caller also has escalate on roles.
With escalate and a binding path, this becomes arbitrary namespace permission injection.
T1 with following verbs:
Arbitrary rights within the namespace, then activated against a subject
A Role may normally only contain rules the caller holds.
escalate on roles waives that, and a RoleBinding is still needed to attach the Role to anyone, so neither verb reaches this alone.
- API Group
- rbac.authorization.k8s.io
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Use escalate on roles to bypass the check that normally prevents writing permissions you do not already hold.
Create or update a Role granting arbitrary permissions in the namespace.
Activate it with a RoleBinding.
Creating or changing the binding still needs bind on the referenced Role, or the caller must already hold the referenced permissions.
Additional rights needed:
· all four; escalate writes the rules, bind permits referencing them
· editing an existing Role instead of creating one