update roles
Rule changes are limited to permissions you already hold, unless the caller also has escalate on roles.
With escalate, update becomes arbitrary namespace permission injection.
T1 with following verbs:
Arbitrary rights added to a Role that subjects are already bound to
escalate on roles waives the restriction that a Role may only contain rights the caller holds.
Editing a Role that already has a RoleBinding takes effect without creating one, so no bind verb is required.
- API Group
- rbac.authorization.k8s.io
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Use escalate on roles to bypass the check that normally prevents writing permissions you do not already hold.
Create or update a Role granting arbitrary permissions in the namespace.
Activate it with a RoleBinding.
Creating or changing the binding still needs bind on the referenced Role, or the caller must already hold the referenced permissions.
Additional rights needed:
· all four; escalate writes the rules, bind permits referencing them
· editing an existing Role instead of creating one