create serviceaccounts/token
Mint a bound token for any ServiceAccount in scope via the TokenRequest API, no existing secret required, with caller-specified expiry.
Targeting a kube-system controller ServiceAccount is T0.
Contextual upgrade to T0:
Targeting a kube-system SA such as kube-controller-manager that carries cluster-admin-equivalent permissions
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Identify a high-privilege ServiceAccount in scope.
The clusterrole-aggregation-controller SA in kube-system has effective cluster-admin rights and is a prime target.
Mint a bound token through the TokenRequest API with an extended lifetime, for example --duration=87600h for ten years.
The API server honors the request unless --service-account-max-token-expiration is set.
kubeadm does not set it, so the full 87600h is issued.
Managed providers commonly do set it.
Authenticate as the ServiceAccount with the minted token.
T0 when targeting kube-system controller service accounts such as clusterrole-aggregation-controller or kube-controller-manager.
Additional rights needed:
Note:
The serviceaccounts/token subresource (TokenRequest API) was promoted to stable in 1.22, making this path available without alpha flags.
No patch exists.
Keep token TTLs short and audit all uses of this verb.