T0system:kube-controller-managercluster
Controller manager identity with full read/write access to most resources needed to reconcile cluster state, including secrets and SA token creation.
- →
Use --use-service-account-credentials so each controller gets its own scoped ServiceAccount instead of sharing one identity.
- →
A compromised single identity here yields broad cluster-wide read/write across nearly all resource types.
- →
Holds list on secrets cluster-wide, which is T0 on its own: one identity reads every credential in every namespace.
Permissions (11)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "", events.k8s.io | events | create patch update |
| coordination.k8s.io | leases | create |
| coordination.k8s.io | leases | get update |
| "" | secrets, serviceaccounts | create |
| "" | secrets | delete |
| "" | configmaps, namespaces, secrets, serviceaccounts | get |
| "" | secrets, serviceaccounts | update |
| authentication.k8s.io | tokenreviews | create |
| authorization.k8s.io | subjectaccessreviews | create |
| * | * | list watch |
| "" | serviceaccounts/token | create |
Audit: RequestResponseK8s docs ↗