Persistence

After gaining control, an attacker keeps it by planting mechanisms that survive credential rotation and pod restarts: RBAC bindings granting a durable identity, malicious workloads and cronjobs that re-establish access, static pods the kubelet runs directly, and admission webhooks that inject backdoors or mint credentials on every relevant API request.

1 min di letturaaggiornato il 7 ott 2026

1 contributore

Holding a Kubernetes cluster means surviving the obvious responses: a rotated token, a deleted pod, a patched node. The durable mechanisms plant themselves in cluster state or on nodes so they outlast those. An RBAC binding grants a long-lived identity that no token rotation removes; a workload or cronjob re-creates access on a schedule; a static pod runs from a node's manifest directory with no API object to delete; and an admission webhook sits in the request path, injecting backdoors or minting credentials whenever a matching object is created.

bash

# what can the current identity create for persistence?
kubectl auth can-i create clusterrolebindings
kubectl auth can-i create mutatingwebhookconfigurations
kubectl auth can-i create cronjobs -A

Subtopics#

RBAC backdoor: a durable identity through bindings.
Malicious workloads: deployments and daemonsets that re-establish access.
CronJobs: scheduled re-entry.
Static pods: pods the kubelet runs from a node manifest directory.
Admission webhooks: intercepting the API request path.
Mutating webhook backdoor: injecting into every matching object.

Persistence

Subtopics#

References#