Kubernetes RBAC

Status: Final

Kubernetes Role-Based Access Control (RBAC) controls what API operations a subject (user, service account, or group) can perform on what resources. Misconfigured RBAC is the primary privilege escalation surface in Kubernetes clusters.

---

Core Objects

Object	Scope	Purpose
Role	Namespace	Permissions on namespaced resources
ClusterRole	Cluster-wide	Permissions on cluster-scoped or all-namespace resources
RoleBinding	Namespace	Binds a Role or ClusterRole to subjects in a namespace
ClusterRoleBinding	Cluster-wide	Binds a ClusterRole to subjects cluster-wide

---

Dangerous Permissions

Permission	Why Dangerous
cluster-admin ClusterRoleBinding	Full cluster control — equivalent to root
get secrets in kube-system	Read service account tokens and credentials
create pods	Run privileged pod → host escape
create/patch rolebindings	Grant yourself any permission
impersonate	Act as any user, service account, or group
exec into pods	Arbitrary command execution in running containers
* (wildcard verb on any resource)	Catch-all escalation
escalate verb on roles	Create bindings with permissions exceeding your own

---

Common Privilege Escalation Paths

1. Has "create pods" → create privileged pod with hostPID/hostNetwork → access node → steal node credentials
2. Has "get secrets" in kube-system → steal service account tokens → escalate via higher-privileged SAs
3. Has "patch rolebindings" → add yourself to cluster-admin binding
4. Has "impersonate" → impersonate cluster-admin directly

---

Audit Logging

Kubernetes API server audit log records all API calls:

• verb: get, list, create, patch, delete
• user.username: who made the request
• objectRef: what resource
• responseStatus.code: HTTP response

Key events to monitor:

• create/patch on rolebindings, clusterrolebindings
• exec into pods (especially in kube-system)
• Service account token creation
• Access to secrets in sensitive namespaces

---

Cross-Links

Topic	Link
Kubernetes Service Accounts	k8s-service-accounts
SPIFFE / SPIRE	spiffe-spire