Glossary
RBAC (Kubernetes)
Kubernetes role-based access control: Roles and ClusterRoles define permissions; RoleBindings and ClusterRoleBindings grant them to subjects.
Kubernetes RBAC authorises API requests with four objects: Role (permissions in one namespace), ClusterRole (cluster-wide or reusable permissions), RoleBinding and ClusterRoleBinding (which grant a role to users, groups or service accounts). Each rule lists verbs on resources.
In an incident, the authorization.k8s.io/reason annotation of each audit event names the binding that allowed the request, and RBAC writes (with their roleRef and subjects in the body) reveal escalation. The verbs escalate, bind and impersonate and * wildcards are the dangerous ones. See RBAC privilege escalation and the RBAC documentation.