services / Kubernetes / StatefulSets

Control Kubernetes StatefulSets objects.

StatefulSets manage Pods, with different guarantees but similar to Deployments, ReplicaSets, and DaemonSets. As such, the primary security concerns are the container images that are running on these Pods, and the resources the Pods consume from the Kubernetes cluster.

apps/​statefulsets.​delete

Deleting a DaemonSets deletes its pods and ephemeral volumes. Persistent Volumes are retained. Logs of the deleted pods disappear permanently when the pods shut down, unless they are exported to an external system for persistence.

Risks

1. Infrastructure destruction (HIGH)
2. Logs destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.