Cluster-admin is the highest practical Kubernetes privilege level. A subject with this role can read, create, update, and delete most cluster resources, including workloads, RBAC rules, secrets, admission policies, and many control-plane objects. In practice, it is cluster superuser access.
This matters because once an attacker or misconfigured service reaches cluster-admin, namespace boundaries stop being meaningful. Many privilege-escalation attacks aim for this point, since it turns a limited foothold into full control of the cluster. Defenders should keep cluster-admin tightly restricted, review ClusterRoleBinding and RoleBinding changes, and apply least privilege to users, service accounts, and controllers. In multicluster systems, a cluster-admin compromise on the hub cluster can affect how other clusters are managed.