Skip to content

Room 28

CLUSTERROLES

The Master Key

  • ClusterRoles grant permissions across ALL namespaces or to cluster-scoped resources.
  • Create a ClusterRole for viewing nodes and secrets across the cluster.

📜 Mission Briefing

  1. Create a ClusterRole cluster-viewer that can get, list nodes and namespaces.
  2. Bind it to ServiceAccount escape-viewer in the default namespace.
  3. Verify the SA can list nodes: kubectl auth can-i list nodes --as=system:serviceaccount:default:escape-viewer.
  4. The ClusterRole annotation contains the password: clrole77.
Key Commands
Command Purpose
kubectl create clusterrole NAME --verb=V --resource=R Create ClusterRole
kubectl create clusterrolebinding NAME --clusterrole=R --serviceaccount=NS:SA Bind
kubectl get clusterroles List ClusterRoles
kubectl get clusterrolebindings List bindings
ClusterRole vs Role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-viewer
  annotations:
    escape-password: "clrole77"
rules:
  - apiGroups: [""]
    resources: ["nodes", "namespaces", "persistentvolumes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: view-cluster
subjects:
  - kind: ServiceAccount
    name: escape-viewer
    namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-viewer
  apiGroup: rbac.authorization.k8s.io

# ClusterRole use cases:
# 1. Access cluster-scoped resources (nodes, PVs, namespaces)
# 2. Same permissions across ALL namespaces
# 3. Non-resource URLs (/healthz, /api, etc.)

# Built-in ClusterRoles:
# cluster-admin: Full access to everything
# admin: Full access within a namespace
# edit: Read-write on most resources
# view: Read-only access

# Aggregate ClusterRoles (merge rules from multiple roles)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
  - apiGroups: ["monitoring.coreos.com"]
    resources: ["prometheuses"]
    verbs: ["get", "list"]
Hints

Hint 1

kubectl create sa escape-viewer
kubectl apply -f clusterrole.yaml
kubectl apply -f clusterrolebinding.yaml

Hint 2

kubectl auth can-i list nodes --as=system:serviceaccount:default:escape-viewer

Hint 3

The password is clrole77.

🔓 Unlock Room 29

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_29/README             \
        -out ../room_29/README.txt        \
        -pass pass:PASSWORD
cat ../room_29/README.txt