Manage StorageClasses

Overview

Field	Value
ID	1056
Name	Manage StorageClasses
Risk Category	Tampering
Risk Level	High
Role Type	ClusterRole
API Groups	storage.k8s.io
Resources	storageclasses
Verbs	create, update, patch, delete
Tags	DenialOfService StorageManipulation Tampering

Description

Grants permission to create, update, or delete StorageClasses. StorageClasses define how dynamic provisioning of persistent volumes occurs. Tampering with StorageClasses can lead to denial of service (e.g., by making storage provisioning fail) or misconfiguration of storage resources.

Abuse Scenarios

Create a new StorageClass that points to a non-existent or malicious provisioner.

kubectl create -f - <<EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: malicious-storage
provisioner: non-existent.provisioner.example.com
reclaimPolicy: Delete
volumeBindingMode: Immediate
EOF
# Example: kubectl create -f - <<EOF ... EOF

Delete an existing StorageClass, preventing new volume provisioning.

kubectl delete storageclass <storageclass-name>
# Example: kubectl delete storageclass standard