To effectively mitigate the vulnerability, the principle of least privilege must be applied to a Role in Kubernetes. This entails granting precise and minimal rights to users and service accounts to decrease the risk of security breaches and unintended consequences. The following steps must be taken:

Limit the privileged container's use only when there is no other option and reserve the ability to create them for the cluster admin only.
Limit privilege to mount volumes from the host. Even if a container is not privileged, an attacker will be able to read any information from the mounted directory/volume depending on the files' permissions.
Only mount specific folders and never the file system root or any system directory, such as /etc.
Review each role in Kubernetes. This can be done using the free tool *RBAC Police from Palo Alto Networks to automatically review each Role and provide a security assessment.

*RBAC Police can be downloaded from its official GitHub repository at RBAC Police. It can either be built on the host with go or a pre-built version can be downloaded from the release pages at Releases.

As the k8sadmin user, download RBAC Police on the vulnerable cluster control plain, run command ./rbac-police_v1.1.2_linux_amd64 eval lib/, and review the results.