RBAC rule "get *" or "get pods/exec" allows exec into Pods in the Web Terminal

Issue

• When the following rule is applied to a Role, it is possible to exec into Pods, why is that?

  rules:
    - verbs:
        - get
        - list
        - watch
      apiGroups:
        - '*'
      resources:
        - '*'
  

• Users can exec into pods with the WebSocket endpoint even without pods/exec create privileges.