Kubernetes ClusterRoleBinding Permission Addition

An authorized actor who can create or update Kubernetes RBAC bindings can grant an existing Role or ClusterRole to a user or service account, adding permissions that may maintain access or enable privilege escalation (ATT&CK T1098.006). The example binds the built-in view role to a test user: across namespaces it allows read-only access to most namespaced objects, but not Secrets or RBAC roles/bindings. Cluster administrators can extend the built-in view role, so inspect its effective rules in the target cluster.