Kubernetes v1.35 Introduces Exec Plugin Allowlist for Enhanced Security
Kubernetes version 1.35 introduces a significant security enhancement aimed at mitigating risks associated with arbitrary executable execution via kubeconfig files. Previously, the kubectl tool could run unspecified executables with user privileges through the exec plugin feature, potentially exposing systems to supply-chain attacks or compromised pipelines. To address this vulnerability, SIG-Auth and SIG-CLI have implemented a beta feature allowing users to restrict which credential plugins are permitted to execute. This new control mechanism is accessible via the client-go library and, more notably, through the kuberc configuration file without requiring application code changes. Users can now define a credentialPluginPolicy and credentialPluginAllowlist to explicitly manage trusted executables. Policies range from AllowAll, maintaining previous behavior, to DenyAll, which blocks all plugins until explicitly allowed. This update provides administrators and developers with greater oversight and control over authentication processes, significantly reducing the attack surface for local machines interacting with Kubernetes clusters. The feature is available in beta without needing specific feature gates, marking a proactive step toward securing the Kubernetes ecosystem against malicious code injection via configuration files.
Wire timeline
Kubernetes v1.35 Introduces Exec Plugin Allowlist for Enhanced Security
Kubernetes version 1.35 introduces a significant security enhancement aimed at mitigating risks associated with arbitrary executable execution via kubeconfig files. Previously, the kubectl tool could run unspecified executables with user privileges through the exec plugin feature, potentially exposing systems to supply-chain attacks or compromised pipelines. To address this vulnerability, SIG-Auth and SIG-CLI have implemented a beta feature allowing users to restrict which credential plugins are permitted to execute. This new control mechanism is accessible via the client-go library and, more notably, through the kuberc configuration file without requiring application code changes. Users can now define a credentialPluginPolicy and credentialPluginAllowlist to explicitly manage trusted executables. Policies range from AllowAll, maintaining previous behavior, to DenyAll, which blocks all plugins until explicitly allowed. This update provides administrators and developers with greater oversight and control over authentication processes, significantly reducing the attack surface for local machines interacting with Kubernetes clusters. The feature is available in beta without needing specific feature gates, marking a proactive step toward securing the Kubernetes ecosystem against malicious code injection via configuration files.
Kubernetes Blog