[web007]

https://github.com/kubernetes/kubernetes/issues/71411 for more details, which includes:

  In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation.