services / Kubernetes / DaemonSets

Control Kubernetes DaemonSets objects.

DaemonSets manage pods, similar to ReplicaSets and StatefulSets. A DaemonSet ensures there is the desired number of pods running on each node. If DaemonSets are allowed to connect to the public internet, it may open up the door for arbitrary code execution for an attacker. See notes on `container/deployments` for mitigations.

apps/​daemonsets.​delete

Deleting a DaemonSets deletes its pods and ephemeral volumes. Logs of the deleted pods disappear permanently when the pods shut down, unless they are exported to an external system for persistence.

Risks

1. Infrastructure destruction (HIGH)
2. Logs destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.