create daemonsets
DaemonSets schedule a pod on every node simultaneously, including control plane nodes if tolerations are set.
Turns a pod-creation primitive into cluster-wide node compromise.
Contextual upgrade to T0:
T0 where the target namespace does not enforce pod security, since the generated pods can then carry privileged and hostPID and land on every node including the control plane at once.
Under baseline or restricted enforcement the pods are rejected at admission and the DaemonSet only reports failures.
- API Group
- apps
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Create a DaemonSet with tolerations using operator Exists so it schedules onto every node, control plane included.
create alone is enough.
The DaemonSet controller creates the pods, so the caller never needs a pods verb.
Put privileged and hostPID in the pod template to reach the host namespaces.
Pod Security Admission evaluates each generated pod against its namespace labels, so a baseline or restricted namespace rejects them and the DaemonSet reports failures instead.
Where the namespace does not enforce pod security, this is root on every node at once.
Additional rights needed: