You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
At the moment the bind verb which is available on Kubernetes clsuter roles does not appear to be supported
kubectl-who-can bind clusterroles
Error: resolving resource: the "clusterroles" resource does not support the "bind" verb, only [create delete deletecollection get list patch update watch]
If would be good if bind was factored into the tool. Similarly to escalate, it would be good to add support for the verb in general, but also to indicate it as another path for privilege escalation.
Why is this needed
The bind verb allows principals which have access to it, to escalate their rights in a cluster to cluster-admin , as they can create new clusterrolebindings. There's a worked example of gaining cluster-admin rights via the bind verb here
The text was updated successfully, but these errors were encountered:
What would you like to be added
At the moment the
bind
verb which is available on Kubernetes clsuter roles does not appear to be supportedIf would be good if bind was factored into the tool. Similarly to escalate, it would be good to add support for the verb in general, but also to indicate it as another path for privilege escalation.
Why is this needed
The bind verb allows principals which have access to it, to escalate their rights in a cluster to cluster-admin , as they can create new clusterrolebindings. There's a worked example of gaining cluster-admin rights via the bind verb here
The text was updated successfully, but these errors were encountered: