Cluster admin

Cluster administrator is effectively root for everything the cluster runs.

It can read every secret, schedule anything on any node and modify the controls that govern all of it. It gets granted broadly because narrower permissions are fiddly, and the result is that compromising any holder compromises every workload. It belongs in the same category as domain administrator.