Update pods/ephemeralcontainers to inject a debug container into an existing running Pod.
The debug container runs in the target Pod context and can access the Pod's mounted volumes, ServiceAccount token, and selected process namespace depending on target/runtime support.
Reaches any process, mount and token inside a privileged Pod already running.
Not the same as kubectl debug node/<name>, which requires create pods and spawns a separate privileged Pod.
Rights needed, any one set:
· what kubectl debug sends; sufficient on its own
· raw PUT form only; kubectl debug is refused with this alone
Note:
CVE-2023-2727 and CVE-2023-2728 were admission/policy bypasses involving ephemeral containers.
The base RBAC risk is the ability to inject code into an existing Pod.