update replicationcontrollers
Modifying an existing ReplicationController's PodTemplateSpec hits the same reconciliation gap as ReplicaSet.
Already-running pods are unaffected, and the poisoned template only lands when a replacement pod is created.
Updating kube-system workloads is T0.
Contextual upgrade to T0:
T0 where the target ReplicationController runs in kube-system, or in any namespace whose pods carry cluster-privileged ServiceAccounts, because the poisoned template then executes with those credentials.
Elsewhere this is a foothold in the namespace rather than cluster compromise.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Patch or update an existing ReplicaSet or ReplicationController pod template
The change does not affect already-running pods.
ReplicaSet/RC only apply the template to pods they create afterward
Wait for or force pod replacement, using manual scale, pod deletion, node eviction, or voluntary disruption
The replacement pod is created from the poisoned template and inherits the workload's existing SA
Update alone forces replacement by scaling replicas (0 then 1).
Delete on pods is not required, it only makes replacement immediate without changing the replica count
Additional rights needed: