create runtimeclasses
RuntimeClasses map pods to specific container runtimes (e.g. kata-containers, gVisor, runc).
Pods could be directed to a privileged or less-sandboxed runtime if one is available on nodes.
This requires separate pods create permission, and the runtime must be installed on nodes.
T1 with following verbs:
Host access on a control plane node, including its credential directory
Placement decides where the pod runs, and the pod spec decides what it can reach once there.
privileged or a hostPath mount turns control-plane placement into host compromise.
Pod Security Admission at baseline or restricted rejects that spec.
Requires these verbs, still T2:
A pod placed on a control plane node, past the taint meant to exclude it
A RuntimeClass schedules nothing on its own.
A pods create verb is needed to reference it, and the named handler must exist on the nodes or the pod stays Pending.
Placement by itself grants no host access.
- API Group
- node.k8s.io
- Scope
- cluster
- Audit Level
- Request
Escalation Paths
Create a RuntimeClass whose scheduling.tolerations and scheduling.nodeSelector target a control-plane node.
Create a pod that sets only runtimeClassName.
The RuntimeClass admission plugin merges the toleration and nodeSelector into the pod spec during that same request.
The pod's own manifest carries neither field, so manifest review, GitOps diffs, and static scanning miss it.
Validating admission does see the merged spec and can still catch it.
Placement alone is a scheduling-policy bypass.
A standard pod sitting on a control-plane node reads nothing it could not read elsewhere.
It becomes host compromise only with a pod spec that reaches the host, such as privileged or a hostPath mount of /etc/kubernetes.
Additional rights needed:
· both; the RuntimeClass schedules nothing on its own