create configmaps
A ConfigMap that a privileged controller renders into workloads carries that controller's cluster-wide identity, whatever wrote it.
Where the controller's config object does not exist yet, create alone supplies it and the controller trusts it on the next reconcile.
Where it already exists, create returns AlreadyExists, so the create-only route is delete paired with create.
Additional rights needed:
Rewrites a controller's existing config object, reaching what patch or update reach
scoped to the controller's own ConfigMap, for example local-path-config in local-path-storage
create returns AlreadyExists against an object that exists, and kubectl apply resolves to a patch, so delete then create is the only create-side route.
It is noisier than patch: two write events, a new uid and resourceVersion, and watchers see a Delete followed by an Add rather than a Modify.
Contextual upgrade to T0:
The controller's rendered pod can land on a control-plane node, for example a volume provisioner helper pod steered there by the attacker's own PVC and nodeSelector: reading that node's admin.conf or CA key gives cluster-admin.
A GitOps controller bound cluster-wide is equally T0, since it applies attacker manifests directly.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
A privileged operator or controller renders an object like a pod from a ConfigMap it owns, then applies it under its own cluster-wide ServiceAccount
Write access to that ConfigMap (patch or update, or delete plus create) sets the rendered pod privileged with hostPID, or supplies arbitrary manifests, without holding those rights directly
For example, the local-path volume provisioner builds its helper pod from its local-path-config ConfigMap.
Poisoning that ConfigMap runs an attacker command as root on a node whenever a PVC is provisioned.
Trigger it with an ordinary PVC and pod in the attacker's own namespace.
The attacker borrows the controller identity.
A GitOps controller is the same pattern, applying attacker manifests cluster-wide
Additional rights needed:
· any one write verb on the controller's ConfigMap
· any one write verb on the controller's ConfigMap
· any one write verb on the controller's ConfigMap
· any one write verb on the controller's ConfigMap
· create plus delete rewrites an existing config object; create alone is enough only where the controller's ConfigMap is absent
Note:
Reaches cluster-admin only where the helper pod can schedule onto a control-plane node and read its admin.conf or CA key.
Where only a worker node is reachable, as on managed control planes, it stops at node compromise.
Guard controller-owned config like kube-system.