Kubernetes 1.37 Pod Certificates & Cluster Trust Bundles Security Mechanism

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Security mechanisms related to Pod Certificates and Cluster Trust Bundles in Kubernetes 1.37 Core Issues: The ServiceAccount JWTs have the following flaws: - They are built directly into the Kubelet and work without any additional configuration. - They follow the principle of least privilege; the node-restricted admission plugin ensures that tokens can only be authenticated by the Kubelet. - They support federated authentication, but tokens may be leaked to other services. - Tokens are "big tokens" (large in size) containing fields such as , , and , posing a risk of information leakage. - Some mitigation measures: ServiceAccount tokens contain only fields such as , , and , rather than full credentials. Scope of Impact Affected Versions: Kubernetes 1.37 Affected Components: - Kubelet (issues PodCertificateRequest objects) - Signer Controller (handles PodCertificateRequest and publishes ClusterTrustBundles) - Application Pods (read certificates and trust bundles) Affected Scenarios: - Workloads using Pod certificates for mTLS authentication - Services relying on ServiceAccount JWTs for authentication - Applications using SPIFFE client certificates Remediation Plan 1. Use Pod Certificates as a replacement for ServiceAccount JWTs: - Enables more granular permission control via and - The certificate includes and - Applications update certificates via file polling or a notification mechanism 2. Configure a Tincert Signer: - Install a third-party signer into the cluster - Use as the signer, supporting DNS SAN and SPIFFE-compatible certificates - Provides the Go library to help applications load SPIFFE files and trust bundles 3. Security Best Practices: - Automatic Rotation: Applications must handle certificate rotation correctly, with a maximum certificate lifetime of 24 hours. - Simplified Automatic Rotation: Use a single file (credential bundle) to store both the private key and the certificate. - The node-restricted admission plugin enforces node isolation, ensuring that a compromised node cannot extend access privileges by requesting certificates. POC / Exploitation Code No specific POC code or exploitation code blocks are included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Kubernetes 1.37 Pod Certificates & Cluster Trust Bundles Security Mechanism