SG-035: Kubernetes Privilege Escalation

Severity: CRITICAL

k8s cluster-admin / host* / runAsUser:0 / allowPrivilegeEscalation

Fires when

• A ClusterRoleBinding grants cluster-admin
• A pod enables host namespaces (hostNetwork / hostPID / hostIPC: true)
• A container runs as root (runAsUser: 0)
• allowPrivilegeEscalation is set to true

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.