An attacker has access to the network segment that the cluster is on.

By default,Pods can connect to the API server(since ServiceAccount tokens are mounted).

However, whether they succeed in acting depends on:

Network Policies(may block egress).

RBAC(controls permissions).

Exact extract (Kubernetes Docs – API Access):

“Pods authenticate to the API server using the service account token mounted into the Pod. Authorization is then enforced by RBAC. NetworkPolicies may further restrict access.”

Clarifications:

A: No default automatic isolation.

B: Not always unrestricted; policies may apply.

D: Pods get minimal default privileges, not automatic elevation.