Lineage
read-only · v1.0
static mock demo — no cluster connection, no oc, no credentials
Static mock demo. This page uses a small bundled sample dataset. It does not connect to a cluster, run oc, or read local credentials.
Privileged ClusterRoles Roles Role grants Cross-namespace Who can Aggregated

Cross-namespace bindings

RoleBindings whose subject is a ServiceAccount in a different namespace than the binding. These paths are useful to review because a CI or automation namespace can hold access inside a separate application namespace.

Yours 3 Unclassified 0 Baseline 0 All 3

No cross-namespace bindings in this view.

Image-puller / image-builder grants

OpenShift's system:image-puller and system:image-builder roles allow pods to pull and push images via the internal registry. The default system:serviceaccounts:<ns> group binding is filtered out — anything else is worth a look. Cross-namespace grants enable silent image access between projects.

No non-default image-puller grants in this view.