Kubernetes and Cloud Native Security Associate (KCSA) free question 3 / 10 · Domain 2: Kubernetes Cluster Component Security
A contractor sends a kubeconfig file and asks a cluster admin to run kubectl with it to check access. What does the kubeconfig page warn about files of this kind?
- A crafted kubeconfig can lead to malicious code execution or file exposure, so inspect it like a script.
- A kubeconfig is checked by the API server before use, so a harmful file is rejected on the first call.
- A kubeconfig is merged with the current one, so its entries replace the admin's user and context.
- A kubeconfig just lists clusters and contexts, so the worst case is a connection to the wrong cluster.
Show the answer and explanation
Answer: A
Why this is correct
The kubeconfig page opens with a warning: "Only use kubeconfig files from trusted sources. Using a specially-crafted kubeconfig file could result in malicious code execution or file exposure. If you must use an untrusted kubeconfig file, inspect it carefully first, much as you would a shell script." A kubeconfig is not just a list of addresses; it holds authentication settings that kubectl acts on and file references that are resolved relative to the file's location. Running kubectl with an unknown file therefore runs with the trust of the person at the keyboard. For a cluster admin, whose own credentials and files are on the same machine, a crafted file is a direct route to those credentials.
Why the other options are wrong
"A kubeconfig just lists clusters and contexts, so the worst case is a connection to the wrong cluster." … The page says kubeconfig files organize information about clusters, users, namespaces, and authentication mechanisms, and its warning goes beyond a wrong connection: a crafted file could result in malicious code execution or file exposure.
"A kubeconfig is checked by the API server before use, so a harmful file is rejected on the first call." … kubectl reads the kubeconfig on the client to find out how to reach the API server, as the page describes. The danger is on the client machine, before any request is sent.
"A kubeconfig is merged with the current one, so its entries replace the admin's user and context." … The page says that if the --kubeconfig flag is set, kubectl uses only the specified file and does not merge it with another one, so the file sent by the contractor does not combine with the admin's own entries.
Treat a kubeconfig like a script
Use kubeconfig files from trusted sources. An untrusted one should be read through before kubectl uses it, much as you would a shell script.