Read Node objects with get and list on nodes.
The flannel.alpha.coreos.com/public-ip annotation gives each node's underlay IP, backend-data gives its VTEP MAC, and spec.podCIDR gives the pod range
This requires a host with flat L2 reach to the node underlay and CAP_NET_ADMIN, such as a bastion, a compromised VM, or a hostNetwork pod with NET_ADMIN
Build a matching device there with ip link add flannel.1 type vxlan id 1 dev eth0 dstport 8472 nolearning
Add the peer by hand with bridge fdb append <vtep-mac> dev flannel.1 dst <node-underlay-ip> self permanent, then ip neigh add <pod-cidr-base> lladdr <vtep-mac> dev flannel.1
Route into the pod range sourced from the attacker's own underlay IP so replies return, using ip route add <pod-cidr> via <pod-cidr-base> dev flannel.1 onlink src <attacker-underlay-ip>
Reach pod IPs directly, defeating Service-level abstraction.
A Service with no endpoints silently drops traffic while the pod IP behind it still answers
Workloads deliberately hidden from this principal become reachable.
The RBAC half is only get and list on nodes, and the rest of the cost is root on an underlay-connected host.
Rights needed, any one set:
· any one; list needs no node name
· any one; list needs no node name
Note:
Demonstrated end to end in the cited CTF from a bastion with flat L2 to the node underlay.
Not reproducible on kind, where every node is a container on one bridge and there is no separate underlay host, so the lack of a local repro is an environment limit, not evidence against it.