T3viewnamespaced
Read-only access to most namespace resources.
Cannot read secrets or modify any state.
- →
Does not include secrets, a common misconception.
Secret access must be explicitly granted.
- →
Aggregation rule: ClusterRoles labeled 'rbac.authorization.k8s.io/aggregate-to-view: "true"' are automatically merged in.
- →
Still useful for reconnaissance: pod names, service endpoints, environment variable names, and event logs reveal cluster topology.
Permissions (12)
| apiGroup | resources / urls | verbs |
|---|---|---|
| "" | configmaps, endpoints, persistentvolumeclaims, persistentvolumeclaims/status, pods, replicationcontrollers, replicationcontrollers/scale, serviceaccounts, services, services/status | get list watch |
| "" | bindings, limitranges, namespaces/status, pods/log, pods/status, replicationcontrollers/status, resourcequotas, resourcequotas/status | get list watch |
| "" | namespaces | get list watch |
| "", events.k8s.io | events | get list watch |
| discovery.k8s.io | endpointslices | get list watch |
| apps | controllerrevisions, daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, replicasets, replicasets/scale, replicasets/status, statefulsets, statefulsets/scale, statefulsets/status | get list watch |
| autoscaling | horizontalpodautoscalers, horizontalpodautoscalers/status | get list watch |
| batch | cronjobs, cronjobs/status, jobs, jobs/status | get list watch |
| extensions | daemonsets, daemonsets/status, deployments, deployments/scale, deployments/status, ingresses, ingresses/status, networkpolicies, replicasets, replicasets/scale, replicasets/status, replicationcontrollers/scale | get list watch |
| policy | poddisruptionbudgets, poddisruptionbudgets/status | get list watch |
| networking.k8s.io | ingresses, ingresses/status, networkpolicies | get list watch |
| resource.k8s.io | resourceclaims, resourceclaims/status, resourceclaimtemplates | get list watch |
Audit: MetadataK8s docs ↗