Hold update on the pods/status subresource, a grant separate from update on pods itself.
The kubelet normally owns these fields
Forge status.podIP on a Service backend pod.
kube-proxy programs the forged IP into the pod's EndpointSlice and routes live Service traffic there, blackholing or redirecting connections
Or forge the Ready condition, marking a healthy backend NotReady to drop it from the Service, or marking an unhealthy pod Ready to insert it into the ready endpoint set
The kubelet reverts status within seconds, but kube-proxy consumes the forged state during that window.
A slow readiness probe cadence widens it
No write access to Services, Endpoints, or EndpointSlices is required
Note:
Reproduced on both versions.
The EndpointSlice adopted a forged status.podIP verbatim and Service traffic dropped during the window, which the kubelet closed in about two seconds.
Forging the Ready condition did not take on probe-less pods.