delete pods
Deleting a pod directly bypasses PodDisruptionBudget enforcement entirely, because PDB checks live only in the eviction subresource, not the core delete path.
Controller-managed pods come back, but this removes PDB-protected pods that eviction-based tooling such as kubectl drain, the autoscaler and node upgrades cannot touch.
Forcing that replacement also activates controller template poisoning, which only takes effect on a new pod.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
A PodDisruptionBudget only constrains the eviction subresource.
The core pod delete path never consults it
Delete a PDB-protected pod directly with delete on pods.
The API server removes it without checking the budget
This defeats a control that blocks kubectl drain, cluster autoscaler consolidation, and node upgrades from disrupting the pod
Same end state as an allowed eviction but reachable when eviction is refused.
It also forces recreation, pairing with template-poisoning that only lands on pod replacement
Additional rights needed: