create poddisruptionbudgets
A PodDisruptionBudget with maxUnavailable=0 or minAvailable=100% permanently blocks node drains and rolling updates.
kubectl drain fails, Deployments cannot roll out, and cluster upgrades stall.
This is a persistent operational DoS, not a privilege escalation.
- API Group
- policy
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Create a PodDisruptionBudget whose selector matches the attacker pod, with minAvailable 1 or maxUnavailable 0.
The eviction API refuses to remove the pod and returns 429, so kubectl drain retries and then gives up.
A bare pod is enough.
The budget reports disruptionsAllowed 0 with reason InsufficientPods, which blocks eviction just as effectively.
This binds the Eviction API only.
Deleting the pod outright, drain --disable-eviction, deleting the budget, or deleting the owning controller all get past it.
The value is delay and friction during maintenance or incident response, not durable persistence.
Additional rights needed:
Note:
Distinct from bypassing a PodDisruptionBudget by deleting a protected pod outright.
Here the budget is the attacker's own tool.
Cordoning a node does not evict anything, so only eviction-based workflows are affected.