Static mock demo. This page uses a small bundled sample dataset. It does not connect to a cluster, run oc, or read local credentials.

Privileged ClusterRoles Roles Role grants Cross-namespace Who can Aggregated

Resurrectable ServiceAccount identities (2)

Critical / high-severity grants whose subject ServiceAccount is gone but the binding is not. Recreating the SA name reactivates the privilege. All severities →

Principal	Severity	Created	Namespace state	Surviving grants
system:serviceaccount:legacy-pipelines:runner resurrectable cluster-admin privileged SCC	critical	1y	ns deleted recreate ns + SA reactivates	ClusterRoleBindinglegacy-runner-admin → cluster-admin (RBAC) SCCprivileged → privileged (SCC user list)
system:serviceaccount:ci:pipeline resurrectable cluster-admin	critical	1y	ns present SA missing	ClusterRoleBindingci-pipeline-clusteradmin → cluster-admin (RBAC) SCCanyuid → anyuid (SCC user list)

Role grants

Every role bound to a non-baseline subject — users, groups, your service accounts. Newest first. The audit view of what was granted to whom, when.

3 grants

Created	Role	Tier	Subject	Scope	Binding
1y	cluster-admin (ClusterRole)	admin++	ServiceAccount runner (legacy-pipelines) ghost	cluster-wide	ClusterRoleBinding/legacy-runner-admin
1y	cluster-admin (ClusterRole)	admin++	ServiceAccount pipeline (ci) ghost	cluster-wide	ClusterRoleBinding/ci-pipeline-clusteradmin
1y	cluster-admin (ClusterRole)	admin++	Group platform-admins	cluster-wide	ClusterRoleBinding/platform-admins-cluster-admin