Locally managed accounts, static administrative credentials, or legacy authentication methods may remain valid after the associated identity should lose access. Requests authenticated by these mechanisms can bypass centrally managed identity lifecycle and revocation controls. Cluster data may be disclosed, cluster state may be changed, and workloads may be disrupted through unauthorized administrative access.
Unmanaged Credentials Bypass Cluster Identity Controls
CCC.K8S.TH16
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP10 | Cloud Identity Integration | The service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN16 | Enforce Managed Cluster Authentication | Bind human access to the Kubernetes API and cluster resources to identities that can be centrally governed, monitored, and revoked. |