Holding a Kubernetes cluster means surviving the obvious responses: a rotated token, a deleted pod, a patched node. The durable mechanisms plant themselves in cluster state or on nodes so they outlast those. An RBAC binding grants a long-lived identity that no token rotation removes; a workload or cronjob re-creates access on a schedule; a static pod runs from a node's manifest directory with no API object to delete; and an admission webhook sits in the request path, injecting backdoors or minting credentials whenever a matching object is created.
# what can the current identity create for persistence?
kubectl auth can-i create clusterrolebindings
kubectl auth can-i create mutatingwebhookconfigurations
kubectl auth can-i create cronjobs -A
Subtopics#
- RBAC backdoor: a durable identity through bindings.
- Malicious workloads: deployments and daemonsets that re-establish access.
- CronJobs: scheduled re-entry.
- Static pods: pods the kubelet runs from a node manifest directory.
- Admission webhooks: intercepting the API request path.
- Mutating webhook backdoor: injecting into every matching object.