Understanding High‑Risk Kubernetes RBAC Permissions and a Graph‑Based Risk Identification System

Kubernetes has become essential in production, bringing security concerns especially around RBAC permission configurations that can lead to privilege escalation.

Risk analysis shows that unlike isolated virtual machines, a compromised node can affect multiple services due to shared resources and misconfigured roles created via direct API calls, dashboards, or other components.

The article enumerates common high‑risk RBAC patterns such as overly permissive role creation, temporary high‑privilege troubleshooting, and missing revocation, and demonstrates how existing container security tools often only list API data without visualizing risks.

To visualize risks, a graph‑based model is proposed where vertices represent Users, Groups, Roles, Authorities, Nodes, Namespaces, etc., and edges describe relationships like ActTo, MemberOf, HoldAuthority, BindTo, and others that capture permission flows.

Examples of high‑risk permissions are shown with corresponding YAML snippets:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: create-pod-account
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: create-pod-clusterrole
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: create-pod-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: create-pod-account
  namespace: default
roleRef:
  kind: ClusterRole
  name: create-pod-clusterrole
  apiGroup: rbac.authorization.k8s.io

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: impersonator
rules:
- apiGroups: [""]
  resources: ["users"]
  verbs: ["impersonate"]
  resourceNames: ["app-fe-user"]

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: role-escalate
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles"]
  verbs: ["create", "escalate"]

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: csr-approver
rules:
- apiGroups: ["certificates.k8s.io"]
  resources: ["certificatesigningrequests"]
  verbs: ["create", "get"]
- apiGroups: ["certificates.k8s.io"]
  resources: ["signers"]
  verbs: ["approve"]

apiVersion: v1
kind: Pod
metadata:
  name: mount-etc
  namespace: default
spec:
  containers:
  - name: nginx
    imagePullPolicy: Always
    image: nginx
    volumeMounts:
    - mountPath: /data
      name: etc-mount
  volumes:
  - name: etc-mount
    hostPath:
      path: /etc

Sample Cypher queries illustrate how to find the shortest privilege‑escalation path, role‑to‑user mappings, and roles containing escalation‑capable permissions.

The system can feed identified risky permissions into SOAR platforms for alerting and help security operations monitor high‑privilege account activity and improve container cluster governance.