The service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls.
Cloud Identity Integration
CCC.K8S.CP10
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH01 | Kubernetes API is Exposed to Untrusted Networks | An API endpoint without network restrictions may be reached from untrusted networks. Cluster resources and configuration can then be enumerated or modified through exposed administrative interfaces. Cluster data may be disclosed, configuration integrity may be lost, and workloads may be disrupted. |
| CCC.K8S.TH02 | Workload Identity Grants Excessive Cloud Access | A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state. |
| CCC.K8S.TH16 | Unmanaged Credentials Bypass Cluster Identity Controls | Locally managed accounts, static administrative credentials, or legacy authentication methods may remain valid after the associated identity should lose access. Requests authenticated by these mechanisms can bypass centrally managed identity lifecycle and revocation controls. Cluster data may be disclosed, cluster state may be changed, and workloads may be disrupted through unauthorized administrative access. |