Identify a running pod you have patch access to, ideally one already carrying a privileged or high-value ServiceAccount.
Patch spec.containers[*].image.
Container images are among the few pod spec fields Kubernetes allows mutating after creation.
patch alone is enough.
A raw JSON Patch naming the container index needs no read, while kubectl patch additionally needs get because it fetches current state to compute the merge.
The kubelet detects the definition change, kills the container, and restarts it running the new attacker-controlled image.
The new container inherits the pod's existing ServiceAccount token, mounted volumes, and any host namespaces or capabilities already granted.
Note:
The API requires only patch.
A JSON Patch against a known container index needs no get, which kubectl needs purely for its client-side merge.
The kubelet restarts the container within seconds.