Built-in roles

Auto-reconciled: any modification or deletion is reverted on the next API server restart.

Audit all ClusterRoleBindings to this role; each one is effectively cluster root.

Membership in the system:masters group also bypasses RBAC entirely and grants equivalent access without any binding.

Use --use-service-account-credentials so each controller gets its own scoped ServiceAccount instead of sharing one identity.

A compromised single identity here yields broad cluster-wide read/write across nearly all resource types.

Holds list on secrets cluster-wide, which is T0 on its own: one identity reads every credential in every namespace.

Node authorizer limits each kubelet to objects related to pods scheduled on that node; NodeRestriction limits unsafe kubelet mutations of Node and Pod objects.

CVE-2022-3294: node name spoofing allowed privilege escalation via this role in Kubernetes <= 1.23.

Compromise of a node identity yields node-level access and can expose credentials for workloads scheduled there.

Can create PersistentVolumes with hostPath; pods mounting those volumes gain direct access to the node filesystem.

Intended exclusively for external storage provisioner controllers; verify no application workloads hold this role.

Can create Roles/RoleBindings in the namespace, but cannot grant permissions it does not already hold unless explicit bind/escalate permissions are present.

Can read/write secrets and run workloads as any ServiceAccount in the namespace, making it T1 in normal namespaces and potentially T0 in kube-system.

Aggregation rule: ClusterRoles labeled 'rbac.authorization.k8s.io/aggregate-to-admin: "true"' are automatically merged in.

In clusters created with Kubernetes v1.22+, default aggregated admin/edit no longer include broad Endpoints write access because of CVE-2021-25740; upgraded clusters may retain legacy grants.

Holds impersonate on serviceaccounts and create on serviceaccounts/token: in a namespace hosting a cluster-privileged ServiceAccount, or on a cluster without PodSecurity restricted, this reaches cluster-admin (contextual T0).

Can read secrets and run Pods as any ServiceAccount in the namespace, so treat it as T1 despite the friendly name.

Aggregation rule: ClusterRoles labeled 'rbac.authorization.k8s.io/aggregate-to-edit: "true"' are automatically merged in.

Cannot manage Roles/RoleBindings by default, but workload creation and ServiceAccount token access are sufficient for many attack paths.

In clusters created with Kubernetes v1.22+, default aggregated edit no longer includes broad Endpoints write access.

Holds impersonate on serviceaccounts and create on serviceaccounts/token: in a namespace hosting a cluster-privileged ServiceAccount, or on a cluster without PodSecurity restricted, this reaches cluster-admin (contextual T0).

Uses create on pods/binding and update/patch on pods/status for scheduling decisions; this is not the RBAC special verb bind.

Reads PriorityClasses, PersistentVolumes, PersistentVolumeClaims, and related scheduling data, giving visibility into workload placement constraints.

Bound to the kube-proxy ServiceAccount by default.

Cluster-wide watch on Services, Endpoints, and EndpointSlices provides full service-routing topology visibility to any holder of this role.

Compromise of the CoreDNS ServiceAccount can expose cluster service-discovery topology and, with config write access, enable DNS poisoning.

The common poisoning vector is write access to the CoreDNS ConfigMap in kube-system, not this read/list role by itself.

Used by aggregated API servers (metrics-server, custom API extensions) to validate caller identities.

A compromised extension server with this role can probe whether arbitrary service account tokens are valid against the API server.

Metrics endpoints can expose sensitive operational data: request rates, error rates, resource names, and label values.

Verify only monitoring ServiceAccounts (Prometheus, Datadog, etc.) are bound to this role.

Reads Node objects cluster-wide, which is T2 rather than pure recon: node annotations can carry overlay network details, so the role is bounded by what those objects hold rather than by being read-only.

Does not include secrets, a common misconception.

Secret access must be explicitly granted.

Aggregation rule: ClusterRoles labeled 'rbac.authorization.k8s.io/aggregate-to-view: "true"' are automatically merged in.

Still useful for reconnaissance: pod names, service endpoints, environment variable names, and event logs reveal cluster topology.

Bound to the 'system:authenticated' group by default; every authenticated user has this.

SelfSubjectAccessReview/SelfSubjectRulesReview lets users enumerate their own permissions, which attackers use to map available attack surface.

Bound to 'system:authenticated' by default and commonly also available in limited form to unauthenticated clients.

Restricting discovery can break kubectl and client tooling; limit unauthenticated network access at the infrastructure level instead.

Bound to both 'system:authenticated' and 'system:unauthenticated'; truly public to the network.

Exposes the Kubernetes version string, which helps attackers target known version-specific CVEs.