Create a PodDisruptionBudget whose selector matches the attacker pod, with minAvailable 1 or maxUnavailable 0.
The eviction API refuses to remove the pod and returns 429, so kubectl drain retries and then gives up.
A bare pod is enough.
The budget reports disruptionsAllowed 0 with reason InsufficientPods, which blocks eviction just as effectively.
This binds the Eviction API only.
Deleting the pod outright, drain --disable-eviction, deleting the budget, or deleting the owning controller all get past it.
The value is delay and friction during maintenance or incident response, not durable persistence.
Note:
Distinct from bypassing a PodDisruptionBudget by deleting a protected pod outright.
Here the budget is the attacker's own tool.
Cordoning a node does not evict anything, so only eviction-based workflows are affected.