Why is granting permission to create Pods or workload resources in a namespace considered a privilege-escalation risk?

AIt implicitly grants the ability to edit the API server manifest

BIt can expose Secrets, ConfigMaps, volumes, and the permissions of ServiceAccounts in that namespace

CIt disables Pod Security Admission automatically

DIt forces the kubelet to trust anonymous requests

Related Questions

In normal Kubernetes operation, which control plane component do nodes and Pods talk to remotely whe...

easy

Which RBAC grant is enough to reveal Secret contents even if get permission was never granted?...

medium

A multi-tenant cluster allows semi-trusted users to create many objects, and the operator is worried...

medium

Which permission is risky because it allows issuing tokens for existing ServiceAccounts?...

medium

A security reviewer sees that a user has get access on nodes/proxy. Why is this more dangerous than ...

hard

View all Kubernetes Threat Model questions

Educational Content — CertQnA practice questions are written against official exam objectives, covering the same domains tested on the real exam. All content is original and independent — not actual exam questions, not affiliated with any certification vendor. Learn more about our content policy

Discussion

Be the first to share your understanding of this concept

⚠️ Discussion is for concept clarification only. Do not share or request actual exam questions or answers.