A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation
Summary: A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation. Detailed analysis: The clusternet has a deployment called cluster-hub inside the clusternet-system Kubernetes namespace, which runs on worker nodes randomly. The deployment has a service account called clusternet-hub, which has a cluster role called clusternet:hub via cluster role binding. The clusternet:hub cluster role has "" verbs of ".*" resources. Thus, if a malicious user …