instruction: Create a Dockerfile for cluster
output: ```dockerfile
  from creating clusterroles with more rights than the user possesses.
  The exception to this is the escalate verb. As noted in the RBAC documentation,
  users with this right can effectively escalate their privileges.
  Bind verb
  Similar to the escalate verb, granting users this right allows for the bypass of Kubernetes
  in-built protections against privilege escalation, allowing users to create bindings to
  roles with rights they do not already have.
  Impersonate verb
  This verb allows users to impersonate and gain the rights of other users in the cluster.
  Care should be taken when granting it, to ensure that excessive permissions cannot be gained
  via one of the impersonated accounts.
  CSRs and certificate issuing
  The CSR API allows for users with create rights to CSRs and update rights on certificatesigningrequests/approval
  where the signer is kubernetes.io/kube-apiserver-client to create new client certificates
  which allow users to authenticate to the cluster. Those client certificates can have arbitrary
  names including duplicates of Kubernetes system components. This will effectively allow for privilege escalation.
  Token request
  Users with create rights on serviceaccounts/token can create TokenRequests to issue
  tokens for existing service accounts.
  Control admission webhooks
  Users with control over validatingwebhookconfigurations or mutatingwebhookconfigurations
  can control webhooks that can read any object admitted to the cluster, and in the case of
  mutating webhooks, also mutate admitted objects.
  Namespace modification
  Users who can perform patch operations on Namespace objects (through a namespaced RoleBinding to a Role with that access) can modify
  labels on that namespace. In clusters where Pod Security Admission is used, this may allow a user to configure the namespace
  for a more permissive policy than intended by the administrators.
  For clusters where NetworkPolicy is used, users may be set labels that indirectly allow
  access to services that an administrator did not intend to allow.
  Kubernetes RBAC - denial of service risks
  Object creation denial-of-service
  Users who have rights to create objects in a cluster may be able to create sufficient large
  objects to create a denial of service condition either based on the size or number of objects, as discussed in
  etcd used by Kubernetes is vulnerable to OOM attack. This may be
  specifically relevant in multi-tenant clusters if semi-trusted or untrusted users
  are allowed limited access to a system.
  One option for mitigation of this issue would be to use
  resource quotas
  to limit the quantity of objects which can be created.
  What's next
  
  To learn more about RBAC, see the RBAC documentation.
  
  Feedback
  Was this page helpful?
  Yes
  No
  
   Thanks for the feedback. If you have a specific, answerable question about how to use Kubernetes, ask it on
  
   Stack Overflow.
   Open an issue in the GitHub Repository if you want to
  
   report a problem
   or
  
   suggest an improvement.
  
   Last modified March 27, 2024 at 4:36 PM PST: Align with style guide (54e1d3308e)
  
    Create child page
   Create documentation issue
   Print entire section
  
  General good practice
  
  Least privilege
  Minimize distribution of privileged tokens
  Hardening
  Periodic review
  
  Kubernetes RBAC - privilege escalation risks
  
  Listing secrets
  Workload creation
  Persistent volume creation
  Access to proxy subresource of Nodes
  Escalate verb
  Bind verb
  Impersonate verb
  CSRs and certificate issuing
  Token request
  Control admission webhooks
  Namespace modification
  
  Kubernetes RBAC - denial of service risks
  
  Object creation denial-of-service
  
  What's next
  
  © 2025 The Kubernetes Authors | Documentation Distributed under CC BY 4.0
  © 2025 The Linux Foundation ®. ICP license: 京ICP备17074266号-3
  ```