Create a pod with privileged + hostPID or hostPath mounting /

Set spec.nodeName to a specific control plane node to force placement there.

Taints are scheduler-only checks, so no toleration is needed

chroot or nsenter into the host to gain root on the node

Read /etc/kubernetes/pki, steal kubelet cert or SA tokens.

This is T0 on the control plane