create priorityclasses
A PriorityClass with globalDefault true silently raises the priority of every future pod that sets no priorityClassName, cluster-wide, without needing pods create permission.
High-priority PriorityClasses also let pods using them preempt (evict) lower-priority pods across namespace boundaries once a node is full, though exploiting that preemption needs a separate pods create permission.
PriorityClass alone cannot cause eviction.
Contextual upgrade to T1:
With an ordinary nodeSelector on the attacker pod, the high priority becomes deterministic cross-namespace precision eviction: a chosen victim pod is preempted off a specific node and the attacker pod takes its place, with no RBAC visibility into the victim namespace.
- API Group
- scheduling.k8s.io
- Scope
- cluster
- Audit Level
- Request
Escalation Paths
Create a PriorityClass with a very high value and preemptionPolicy PreemptLowerPriority.
Create a pod referencing that PriorityClass, with requests large enough that it only fits by evicting a running pod.
The scheduler preempts a lower-priority victim to make room.
This crosses namespaces, because priority is compared node-wide and the scheduler has no notion of which namespace owns the capacity.
The gain is scheduled capacity taken from another team, not credentials or API permissions.
Additional rights needed:
· both; a PriorityClass preempts nothing until a workload references it, and any controller-backed workload verb does instead of pods
Create a PriorityClass with globalDefault true.
Every pod created afterwards with no priorityClassName inherits that priority, cluster-wide.
No pod create verb is needed.
The effect lands on other people's future workloads, not on one the attacker submits.
Existing pods keep the priority they were admitted with, so the change is invisible until the next rollout.
Only one PriorityClass may be the global default, so setting it also displaces whatever the platform team configured.
Additional rights needed: