Kubernetes RBAC and resource-specific authority

Mechanism

Kubernetes RBAC grants verbs over resources within a namespace or cluster. Reading secrets, creating workloads, executing in containers, and modifying role bindings are different capabilities. A role that appears narrow can still expose authority indirectly through a workload that mounts a stronger service account or host resource.

Practical method

Identify the current context and namespace. Query allowed verbs, then inspect relevant bindings and service accounts. Draw the path from a granted API operation to the resulting workload authority. Validate a harmless API read before assuming cluster-wide access.

kubectl config current-context
kubectl auth can-i --list --namespace lab
kubectl auth can-i get secrets --namespace lab

Interpreting evidence

Record namespace scope and resource names. A yes result for one verb does not grant every operation on that resource or on its subresources.

Pitfalls and limits

Admission controls can reject an action RBAC permits. exec and logs are subresources. Role aggregation and external authorizers may add behavior beyond one visible binding.