create clustertrustbundles
Insert a rogue CA into a ClusterTrustBundle.
This requires the ClusterTrustBundles feature gate explicitly enabled, and it is not on by default, even in v1.36.
When enabled, only pods that explicitly project a matching bundle trust the inserted CA, opening targeted TLS interception for those workloads.
Core Kubernetes components are not affected automatically.
Contextual upgrade to T1:
T1 where workloads already project a clusterTrustBundle volume, since they will trust a CA added to the bundle and their outbound TLS becomes interceptable.
Pods relying on the container image's own CA store are unaffected, so on a cluster where nothing projects a bundle this grants no interception at all.
- API Group
- certificates.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Create a ClusterTrustBundle containing a CA certificate you control.
Nothing trusts it on creation.
Only pods that project it through a clusterTrustBundle volume read the bundle at all.
Those pods then accept certificates signed by that CA, so the TLS connections they make can be intercepted.
Workloads using the container image's own CA store, which is the common case, are unaffected.
Additional rights needed:
Note:
Requires the ClusterTrustBundle feature to be enabled and, separately, workloads that project the bundle.
Check with kubectl api-resources | grep trustbundle.
Inert on a cluster where nothing projects it.