Deleting the mirror pod in the API does not stop a static pod. The kubelet runs static pods from files on the node, and the API server only reflects them. To change or remove one, you edit the file. That makes write access to the manifests directory a powerful node level permission.
What a static pod is
The Kubernetes docs describe static pods as pods managed directly by the kubelet on a node. The kubelet watches a directory set by staticPodPath in its configuration, and it periodically scans the directory and creates or deletes static pods as files appear or disappear. It can also fetch a manifest from a URL given by staticPodURL.
Kubeadm style clusters use this for control plane components, which is why the manifests directory is sensitive.
Mirror pods
For each static pod the kubelet creates a read only mirror pod in the API, so you can see it with kubectl. Labels propagate to the mirror. But the docs are clear on control: if you delete the mirror with kubectl, the kubelet does not remove the static pod. If you stop its container, the kubelet restarts it.
| Action | Result |
|---|---|
| kubectl delete on the mirror pod | Static pod keeps running |
| Stop the container on the node | Kubelet restarts it |
| Delete or edit the manifest file | Pod changes or goes away |
Why this matters for supply chain control
Admission policies and image rules live in the API. A static pod starts from a file on disk. A person or process with write access to that directory can run a container that never went through your admission checks at the point it was created. Check what the API-side controls can see on your version, since this post confirmed only the mirror pod behavior.
What to do
- Find out which nodes use staticPodPath and whether staticPodURL is set. Avoid the URL option unless you need it.
- Restrict write access to the manifests directory to the tooling that manages the node.
- Watch for unexpected files. The docs warn that the kubelet reads all files not starting with a dot, so a stray backup file can override a real manifest.
- Alert on mirror pods that you did not expect, by listing pods whose names end with a node name.
- Scan the images referenced in those manifests like any other workload image.
Related: what privileged true means in Kubernetes.
Quick check
Can I remove a static pod with kubectl delete?
No. Deleting the mirror pod leaves the static pod running. Remove the manifest file.
Why does a backup file cause trouble in the manifests folder?
The kubelet reads every file not starting with a dot, with no extension filter, so a backup copy can silently override the current manifest.
Safeguard asset discovery and image scanning can cover the images those manifests reference once you list them.
Sources
Last reviewed: 19 October 2026.
