T1system:nodecluster
Kubelet node identity role.
Grants the API access a kubelet needs for pods scheduled to that node, including reading referenced secrets/configmaps and reporting node/pod status.
Correct scoping depends on the Node authorizer and NodeRestriction admission plugin.
- →
Node authorizer limits each kubelet to objects related to pods scheduled on that node; NodeRestriction limits unsafe kubelet mutations of Node and Pod objects.
- →
CVE-2022-3294: node name spoofing allowed privilege escalation via this role in Kubernetes <= 1.23.
- →
Compromise of a node identity yields node-level access and can expose credentials for workloads scheduled there.
Permissions (25)
| apiGroup | resources / urls | verbs |
|---|---|---|
| authentication.k8s.io | tokenreviews | create |
| authorization.k8s.io | localsubjectaccessreviews, subjectaccessreviews | create |
| "" | services | get list watch |
| "" | nodes | create get list watch |
| "" | nodes/status | patch update |
| "" | nodes | patch update |
| "", events.k8s.io | events | create patch update |
| "" | pods | get list watch |
| "" | pods | create delete |
| "" | pods/status | patch update |
| "" | pods/eviction | create |
| "" | configmaps, secrets | get list watch |
| "" | persistentvolumeclaims, persistentvolumes | get |
| "" | endpoints | get |
| certificates.k8s.io | certificatesigningrequests | create get list watch |
| coordination.k8s.io | leases | create delete get patch update |
| storage.k8s.io | volumeattachments | get |
| "" | serviceaccounts/token | create |
| "" | persistentvolumeclaims/status | get patch update |
| storage.k8s.io | csidrivers | get list watch |
| storage.k8s.io | csinodes | create delete get patch update |
| node.k8s.io | runtimeclasses | get list watch |
| resource.k8s.io | resourceclaims | get |
| resource.k8s.io | resourceslices | deletecollection |
| "" | serviceaccounts | get |
Audit: RequestResponseK8s docs ↗