Kubetier
T1

Developer exec access to namespace admin

Namespace admin

Every credential in a namespace, reached from an exec grant meant for debugging. The pod you exec into runs its own ServiceAccount, and that token is yours the moment you have a shell.

Step 1: exec into a privileged pod. Tier T1. audit: RequestResponse.exec into a privilegedpod1Step 2: read the projected token. This step is not governed by RBAC.2Step 3: namespace secret theft. Tier T1. audit: RequestResponse.namespace secret theft3Developer (exec in one namespace)Developerexec in one namespacePod (runs a better ServiceAccount)Podruns a betterServiceAccountServiceAccount tokenServiceAccount tokenNamespace admin (database and registry credentials)Namespace admindatabase and registrycredentials
  • RBAC
  • runtime
  • governed by RBAC
  • not governed by RBAC