Create a pod using hostNetwork, hostPID, hostIPC or hostPath as available
hostNetwork reaches cloud metadata and the API server from the node network namespace.
hostPID reads host process env vars
hostPath to / reads other pods' SA tokens under /var/lib/kubelet and the cluster CA private key if scheduled on a control plane node
Note:
On a control plane node, hostPath to / exposes the cluster CA private key for full cluster compromise.
On worker nodes this is node-level only (T1).