update statefulsets
Modifying an existing StatefulSet's PodTemplateSpec injects attacker code into a workload running under its existing ServiceAccount.
With the default RollingUpdate strategy this reconciles existing pods automatically.
With updateStrategy OnDelete, the change only lands on pods recreated afterward.
Updating kube-system workloads is T0.
Contextual upgrade to T0:
Updating a kube-system StatefulSet injects code into core cluster components
- API Group
- apps
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Patch or update an existing Deployment, DaemonSet, or StatefulSet pod template, or a CronJob's jobTemplate.
Add an attacker sidecar or replace the image.
A Deployment rolls out at once, as do DaemonSets and StatefulSets under the default RollingUpdate strategy.
Under updateStrategy OnDelete they wait for pod recreation.
A CronJob applies the change on its next scheduled run with no extra trigger.
Code runs with the workload's existing ServiceAccount, which is T0 for kube-system workloads.
Additional rights needed: