Dangerous
kubectl create clusterrolebinding sa-admin --clusterrole=cluster-admin --serviceaccount=default:defaultcross-platform · yaml · Expert
Grants cluster-admin to the default service account, which every pod in that namespace uses unless told otherwise. Any workload in the namespace, including a compromised one, immediately inherits full control of the cluster.
Signals to notice
- cluster-admin bound to a default service account
- Every pod in the namespace inherits it
- Reads like ordinary RBAC configuration
Think you can spot these under time pressure?
Start TrainingMore Kubernetes
kubectl get pods -n defaultIntermediatekubectl delete namespace productionIntermediatekubectl describe pod web-0Advancedkubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -dExpertkubectl auth can-i --list --as=system:serviceaccount:default:defaultNightmarekubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.spec.containers[*].image}{"\n"}{end}' | sort | uniq -c | sort -rnNightmare