update replicasets
Modifying an existing ReplicaSet's PodTemplateSpec does not touch already-running pods.
Unlike Deployment/DaemonSet/StatefulSet, a ReplicaSet never reconciles running pods against a changed template.
The poisoned template only lands on a replacement pod, from manual scaling, pod deletion, or node eviction.
A crashing container is restarted in place by the kubelet and never sees the new template.
Updating kube-system workloads is T0.
Contextual upgrade to T0:
T0 where the target ReplicaSet runs in kube-system, or in any namespace whose pods carry cluster-privileged ServiceAccounts, because the poisoned template then executes with those credentials.
Elsewhere this is a foothold in the namespace rather than cluster compromise.
- API Group
- apps
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Patch or update an existing ReplicaSet or ReplicationController pod template
The change does not affect already-running pods.
ReplicaSet/RC only apply the template to pods they create afterward
Wait for or force pod replacement, using manual scale, pod deletion, node eviction, or voluntary disruption
The replacement pod is created from the poisoned template and inherits the workload's existing SA
Update alone forces replacement by scaling replicas (0 then 1).
Delete on pods is not required, it only makes replacement immediate without changing the replica count
Additional rights needed: