patch leases

Leases back leader election for kube-scheduler, kube-controller-manager, and operators.

Overwriting a component's Lease makes it crash and re-elect, a gap of tens of seconds with nothing acting.

Repeated patches compound kubelet CrashLoopBackOff.

Operational DoS, not privilege escalation.

Escalation Paths

Leader election for control-plane components like the scheduler and controller-manager is coordinated through a Lease in kube-system
Patch the component's Lease to set holderIdentity to a foreign value with a fresh renewTime, so the running leader observes a conflicting holder
The real component stops leading and its static pod crashes.
A full crash, restart, and re-election cycle runs for tens of seconds with no scheduler or controller acting
Repeating the patch after each recovery compounds kubelet CrashLoopBackOff, sustaining and lengthening the outage

Additional rights needed:

none