update pods/status
Overwrite a pod's status fields (conditions, podIP, phase).
Forging status.podIP makes kube-proxy program that IP into the pod's EndpointSlice, redirecting or blackholing live Service traffic until the kubelet reverts it seconds later.
Forging the Ready condition transiently drops a healthy backend from a Service or inserts an unhealthy one.
Needs only update on pods/status, not endpoint write access.
pods/proxy is unaffected, resolving the pod's real address through the kubelet.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Hold update on the pods/status subresource, a grant separate from update on pods itself.
The kubelet normally owns these fields
Forge status.podIP on a Service backend pod.
kube-proxy programs the forged IP into the pod's EndpointSlice and routes live Service traffic there, blackholing or redirecting connections
Or forge the Ready condition, marking a healthy backend NotReady to drop it from the Service, or marking an unhealthy pod Ready to insert it into the ready endpoint set
The kubelet reverts status within seconds, but kube-proxy consumes the forged state during that window.
A slow readiness probe cadence widens it
No write access to Services, Endpoints, or EndpointSlices is required
Additional rights needed:
Note:
Reproduced on both versions.
The EndpointSlice adopted a forged status.podIP verbatim and Service traffic dropped during the window, which the kubelet closed in about two seconds.
Forging the Ready condition did not take on probe-less pods.