gcp-gke-rbac-create-clusterrolebinding
K8s RBAC clusterrolebindings/create (or wildcard *) verb lets a principal bind cluster-admin to any subject, effectively granting itself full cluster control - the k8s privilege escalation via RBAC.
match (effective permission)
{
"action": "k8s:clusterrolebindings create",
"resource_type": "k8s/ClusterRoleBinding"
}
where
?principal holds clusterrolebindings/create (or a wildcard * covering it) via a ClusterRoleBinding or RoleBinding in scope
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any k8s subject (self-grant to cluster-admin)> |
| permissions | k8s:clusterrolebindings create |
| conditions | iam_permission |
| state logic | ACTIVE if the RBAC grant allows creating ClusterRoleBindings at cluster scope. BLOCKED if an admission webhook / OPA-Gatekeeper / Kyverno policy denies ClusterRoleBinding creation or restricts ClusterRole references to non-admin roles. |
Narrative
{principal.name} can create ClusterRoleBindings in {cluster.name} (k8s clusterrolebindings/create), allowing it to bind cluster-admin to its own identity, granting full cluster control and pods/exec on all pods.
Raw rule rules/derived/gcp/gke.yaml
id: gcp-gke-rbac-create-clusterrolebinding
emits: CanGrantPermission
description: "K8s RBAC clusterrolebindings/create (or wildcard *) verb lets a principal bind cluster-admin\
\ to any subject, effectively granting itself full cluster control \u2014 the k8s privilege escalation\
\ via RBAC."
match_effective_permission:
action: k8s:clusterrolebindings create
resource_type: k8s/ClusterRoleBinding
where:
- ?principal holds clusterrolebindings/create (or a wildcard * covering it) via a ClusterRoleBinding or
RoleBinding in scope
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <any k8s subject (self-grant to cluster-admin)>
permissions:
- k8s:clusterrolebindings create
conditions:
- iam_permission
state_logic: ACTIVE if the RBAC grant allows creating ClusterRoleBindings at cluster scope. BLOCKED
if an admission webhook / OPA-Gatekeeper / Kyverno policy denies ClusterRoleBinding creation or restricts
ClusterRole references to non-admin roles.
confidence: 0.92
derived_from:
- <RBAC ClusterRoleBinding granting clusterrolebindings/create to ?principal>
false_positive_note: "Only emit when the create verb is confirmed on clusterrolebindings in the rbac.authorization.k8s.io\
\ API group at cluster scope (not just namespace scope). A RoleBinding scoped to a namespace does\
\ NOT grant cluster-wide ClusterRoleBinding creation. Admission webhooks may restrict which ClusterRoles\
\ may be referenced \u2014 honor as BLOCKED when such a policy is confirmed."
narrative: '{principal.name} can create ClusterRoleBindings in {cluster.name} (k8s clusterrolebindings/create),
allowing it to bind cluster-admin to its own identity, granting full cluster control and pods/exec
on all pods.'