24 lines
1.1 KiB
Markdown
24 lines
1.1 KiB
Markdown
1. The failed request was an attempt by `system:serviceaccount:default:unknown`
|
|
to create ClusterRoleBinding `unknown-admin`. Response code `403` and status
|
|
`Failure` prove that the API server rejected the request.
|
|
|
|
2. the requested principle came from system:serviceaccount:checkout:release-bot
|
|
|
|
3. first successful escalation event is audit ID: b3, timestamp: 2026-08-25T04:22:11Z, verb: create, resourcetype: rolebindings, namespace: checkout, resourceName: release-bot-secret-reader
|
|
|
|
4. Secret `checkout/payment-gateway` was accessed successfully with a `get`
|
|
request that returned HTTP 200.
|
|
|
|
5. The principal opened a `pods/exec` session in Pod
|
|
`checkout/checkout-api-6d8f`; HTTP 101 shows the connection was upgraded.
|
|
|
|
6. First, delete RoleBinding
|
|
`checkout/release-bot-secret-reader` to revoke the escalated Secret access.
|
|
|
|
Second, isolate or stop the workload using ServiceAccount
|
|
`checkout/release-bot`, and terminate its access to Pod
|
|
`checkout/checkout-api-6d8f`.
|
|
|
|
Third, rotate the credential stored in Secret
|
|
`checkout/payment-gateway`, update its authorized consumers, and invalidate the
|
|
old credential. |