update cronjobs
Modifying an existing CronJob's jobTemplate injects attacker code that applies automatically the next time the schedule fires, no additional trigger needed.
Updating kube-system workloads is T0.
Contextual upgrade to T0:
Updating a kube-system CronJob injects code into core cluster components
- API Group
- batch
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Patch or update an existing Deployment, DaemonSet, or StatefulSet pod template, or a CronJob's jobTemplate.
Add an attacker sidecar or replace the image.
A Deployment rolls out at once, as do DaemonSets and StatefulSets under the default RollingUpdate strategy.
Under updateStrategy OnDelete they wait for pod recreation.
A CronJob applies the change on its next scheduled run with no extra trigger.
Code runs with the workload's existing ServiceAccount, which is T0 for kube-system workloads.
Additional rights needed: