services / Google Cloud / Kubernetes Engine ClusterRole Bindings

A ClusterRoleBinding is used to associate a ClusterRole with one or more principals (users, groups, or service accounts). It establishes a connection between a set of permissions defined in a ClusterRole and the entities that should have those permissions. ClusterRoles are scoped to the entire Kubernetes cluster.

ClusterRoles are only definitions of permissions. A role does not take effect unless assigned to principal via a ClusterRoleBinding.

container.​clusterRoleBindings.​list

List all ClusterRoleBindings within a namespace

Risks

1. Policy discovery (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.