update deployments
Modifying an existing Deployment's PodTemplateSpec injects attacker code into a production workload, running under its existing ServiceAccount permissions.
Updating kube-system workloads is T0.
Contextual upgrade to T0:
Updating a kube-system Deployment injects code into core cluster components
- API Group
- apps
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Patch or update an existing Deployment, DaemonSet, or StatefulSet pod template, or a CronJob's jobTemplate.
Add an attacker sidecar or replace the image.
A Deployment rolls out at once, as do DaemonSets and StatefulSets under the default RollingUpdate strategy.
Under updateStrategy OnDelete they wait for pod recreation.
A CronJob applies the change on its next scheduled run with no extra trigger.
Code runs with the workload's existing ServiceAccount, which is T0 for kube-system workloads.
Additional rights needed: