Kubetier
T1CSR-minted node identity for a named node

  1. The submission guard rejects only the literal group system:masters, so an O=system:nodes request is accepted

  2. Request a certificate with O=system:nodes and CN=system:node: followed by the name of a real node

  3. Approving it yields a CA-signed client certificate, issued in seconds and valid for years

  4. The Node authorizer then grants the Secrets, ConfigMaps and PVCs referenced by pods scheduled on that node

  5. Objects no pod on that node references are refused as having no relationship to it, and bulk list is refused, so the reach is that node workload set

  6. A TokenRequest bound to a pod on that node mints that pod ServiceAccount token, including one carrying a cloud identity audience

  7. There is no revocation for client certificates, so deleting the request leaves an issued certificate valid until it expires

Rights needed:

Note:

Not patched and not a defect: only system:masters is guarded at submission.

Remediation is preventive, since an issued certificate cannot be revoked and only rotating the CA invalidates it.

K8s docs ↗