← Permission ReferenceK8s docs ↗ K8s docs ↗
T1
escalate roles
Inject arbitrary permissions into any Role in the accessible namespace.
The escalate verb bypasses only the role write check.
Activating the change still requires bind on roles separately, to create the RoleBinding that references it.
- API Group
- rbac.authorization.k8s.io
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Use escalate on roles to bypass the check that normally prevents writing permissions you do not already hold.
Create or update a Role granting arbitrary permissions in the namespace.
Activate it with a RoleBinding.
Creating or changing the binding still needs bind on the referenced Role, or the caller must already hold the referenced permissions.
Additional rights needed:
· all four; escalate writes the rules, bind permits referencing them
· editing an existing Role instead of creating one