T1 redirect a name the workload already trusts A rewrite rule in the CoreDNS ConfigMap changes what every pod in the cluster resolves.
CoreDNS picks it up without a restart, though not instantly: measured at 43 seconds here, because the reload is polled rather than pushed.
Break the chain. Keep write access to kube-system ConfigMaps to the control plane, and alert on changes to the CoreDNS configuration specifically.
the client connects to the listener instead Resolution now points at an address you control, so the connection lands on your listener rather than the Service.
During the reload window the replicas disagree, so traffic alternates between the real Service and yours until both have picked the change up.
Precondition. The hop the client takes is plaintext, or it does not verify the certificate against the name it asked for. Plaintext is the common case inside a cluster; a client that does verify refuses outright.
Break the chain. Require TLS between workloads and verify the certificate against the name asked for. That is what breaks this hop, and no permission change substitutes for it.
the credential on the wire arrives in the clear You are in the middle of the connection, so everything the client sends is yours: API keys, database passwords, session tokens.
A ServiceAccount token is the example that continues into the cluster, and it travels on integrations like Vault auth, TokenReview caller checks and bearer-token scraping.
Break the chain. Run mTLS between workloads so the interception fails whatever is being sent, and prefer short-lived audience-bound tokens so a captured one is refused elsewhere.
T1 act as the workload whose token you took The token authenticates as that exact ServiceAccount and carries its permissions, no more and no less.
Where the intercepted client is a controller or operator, that is commonly read across the namespace it manages.
Break the chain. Scope workload identities to the objects they name. The ceiling of this chain is whatever the intercepted client was trusted with.
Sources: kubernetes.io, kubernetes.io