Kubernetes v1.35: Tightening Security with Exec Plugin Allowlists
In an era where security breaches are a constant threat, Kubernetes v1.35's new feature to restrict executables invoked by kubeconfigs is a game changer. This capability allows you to define a clear policy on which credential plugins kubectl can execute, significantly reducing the risk of unauthorized access and potential exploits.
The mechanism is straightforward. You can enforce this policy by modifying your kuberc configuration file to include two key fields: credentialPluginPolicy and credentialPluginAllowlist. The credentialPluginPolicy can be set to AllowAll, DenyAll, or Allowlist, with the default being AllowAll. When you specify Allowlist, you must also define the credentialPluginAllowlist, which details the exact plugins that are permitted. For instance, you might configure it to allow only specific plugins like /usr/local/bin/cloudco-login and get-identity. This level of granularity helps ensure that only trusted plugins can be executed, thus bolstering your security posture.
In production, be mindful of the implications of setting your policy to DenyAll. If you do, any attempt to use a plugin not explicitly allowed will result in errors, such as "plugin 'cloudco-login' not allowed: policy set to 'DenyAll'." This feature is in beta and available without feature gates, so you can adopt it right away. However, always test configurations in a staging environment before rolling them out to production to avoid disruptions.
Key takeaways
- →Configure `credentialPluginPolicy` to control plugin execution.
- →Use `credentialPluginAllowlist` to specify allowed credential plugins.
- →Beware of the `DenyAll` policy, which can block necessary plugins.
- →Test your configuration in a staging environment before production deployment.
Why it matters
Implementing an exec plugin allowlist can drastically reduce the attack surface of your Kubernetes cluster, protecting sensitive credentials from being compromised by unauthorized plugins.
Code examples
1apiVersion: kubectl.config.k8s.io/v1beta1
2kind: Preference
3credentialPluginPolicy: Allowlist
4credentialPluginAllowlist:
5- name: /usr/local/bin/cloudco-login
6- name: get-identityapiVersion: kubectl.config.k8s.io/v1beta1
kind: Preference
credentialPluginPolicy: AllowAllapiVersion: kubectl.config.k8s.io/v1beta1
kind: Preference
credentialPluginPolicy: DenyAllWhen NOT to use this
The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.
Want the complete reference?
Read official docsUnified observability — logs, uptime monitoring, and on-call in one place. Used by 50,000+ engineering teams to ship faster and sleep better.
Try Better Stack free →Runtime Supply Chain Verification with NRI: Securing Your Kubernetes Deployments
In a world where supply chain attacks are rampant, ensuring the integrity of your container images is crucial. The Node Resource Interface (NRI) allows you to enforce supply chain verification at runtime, leveraging plugins to validate image attestations before they even start. Dive into how this mechanism works and what you need to watch out for in production.
Unlocking Data Security: Confidential Containers in Kubernetes
Confidential Containers are revolutionizing data protection in cloud-native environments by leveraging Trusted Execution Environments (TEEs). This technology ensures that sensitive workloads can run securely on third-party infrastructure without exposing data to operators.
Making Kyverno Think It's in Production: A Practical Guide
Ever wondered how to test your Kubernetes policies without deploying them? Learn how to leverage Kyverno's CLI to simulate a production environment, ensuring your policies are battle-tested before they hit the cluster. This article dives into the mechanics of using resolveResourcesMockData for reliable policy evaluation.
Get the daily digest
One email. 5 articles. Every morning.
No spam. Unsubscribe anytime.