Kubernetes v1.35 Introduces Secure Token Handling for CSI Drivers
Kubernetes version 1.35 introduces a significant security refinement for Container Storage Interface (CSI) drivers regarding the handling of service account tokens. Previously, tokens were passed via the volume_context field, which is not designed for sensitive data. This approach led to security vulnerabilities, such as CVE-2023-2878 and CVE-2024-3744, where tokens were accidentally logged because standard sanitization tools do not treat volume context as sensitive. To address this, Kubernetes v1.35 launches a beta feature allowing CSI drivers to opt-in to receiving tokens through the secrets field in NodePublishVolumeRequest. This field is specifically designated for sensitive information within the CSI specification. The new mechanism ensures backward compatibility, allowing existing drivers to continue functioning while enabling updated drivers to adopt the more secure method. This change aims to eliminate inconsistent sanitization logic across different drivers and prevent accidental exposure of credentials in logs, marking a crucial step forward in Kubernetes storage security standards.
Wire timeline
Kubernetes v1.35 Introduces Secure Token Handling for CSI Drivers
Kubernetes version 1.35 introduces a significant security refinement for Container Storage Interface (CSI) drivers regarding the handling of service account tokens. Previously, tokens were passed via the volume_context field, which is not designed for sensitive data. This approach led to security vulnerabilities, such as CVE-2023-2878 and CVE-2024-3744, where tokens were accidentally logged because standard sanitization tools do not treat volume context as sensitive. To address this, Kubernetes v1.35 launches a beta feature allowing CSI drivers to opt-in to receiving tokens through the secrets field in NodePublishVolumeRequest. This field is specifically designated for sensitive information within the CSI specification. The new mechanism ensures backward compatibility, allowing existing drivers to continue functioning while enabling updated drivers to adopt the more secure method. This change aims to eliminate inconsistent sanitization logic across different drivers and prevent accidental exposure of credentials in logs, marking a crucial step forward in Kubernetes storage security standards.
Kubernetes Blog