Kubernetes RBAC was built to lock down access. Done right, it enforces clear boundaries. Done wrong, it hands attackers the keys. Many clusters fail here because guardrails are loose, rules are vague, and audit trails are blind. The path from a limited service account to full cluster-admin can be just a few missteps away.
Privilege escalation in Kubernetes often happens quietly. A pod starts with read-only permissions. Then, it grabs a Role that lets it create Pods with higher privileges. Soon, an attacker is mounting host paths, reading secrets, or installing persistence. Without strict RBAC controls, this chain reaction is simple to trigger.
Effective guardrails start with the principle of least privilege. Every Role and ClusterRole must be explicit. Wildcards in verbs or resources are an open invitation for abuse. Avoid granting roles that include sensitive verbs like create, patch, or delete unless they are absolutely needed. Break permissions into smaller, dedicated roles instead of bloated ones that cover multiple domains.