← Permission Reference

T2

create pods/eviction

The eviction subresource alone, with no pod read or delete, removes a named pod on demand.

Forces victim workloads to reschedule, useful for targeted disruption or steering a pod onto an attacker-controlled node.

API Group: (core)
Scope: namespaced
Audit Level: Request

Escalation Paths

T2Targeted pod eviction via the eviction subresource

With create on the pods/eviction subresource alone, and no pod get, list, or delete, evict a named victim pod
Forces the victim workload to reschedule, which can move it onto an attacker-controlled node, or cause targeted disruption

Additional rights needed:

none