TL;DR

Kubernetes v1.35 adds a credential plugin policy and allowlist as a beta feature to enhance security by restricting which credential plugins kubectl can execute.

What happened

In Kubernetes version 1.35, a new security feature has been introduced that restricts the executables invoked via kubeconfigs using an exec plugin allowlist. This ensures users have better control over what code runs on their systems when interacting with external identity providers.

Why it matters for ops

This update addresses security concerns related to arbitrary executable execution through kubeconfig files, offering new policy options like AllowAll, DenyAll, and Allowlist for enhanced system protection.

Action items

  • Configure kubectl using the credentialPluginPolicy and credentialPluginAllowlist fields in kuberc.
  • Review kubeconfigs for potential security risks involving exec commands.
  • Monitor feedback channels for future updates on plugin policy enhancements.

Source link

https://kubernetes.io/blog/2026/01/09/kubernetes-v1-35-kuberc-credential-plugin-allowlist/