The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence.
Admission Policy Enforcement
CCC.K8S.CP18
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH05 | Privileged Workloads Escape Isolation | Workloads granted privileged execution, host namespaces, host paths, or unrestricted Linux capabilities may bypass container isolation controls. Processes can then read node data, alter host state, or disrupt neighboring workloads, defeating the confidentiality, integrity, and availability boundaries of the shared worker infrastructure. |
| CCC.K8S.TH08 | Cluster Extensions Execute Untrusted Code | An operator, controller, admission webhook, or managed extension installed without verified provenance and constrained permissions may execute untrusted code with cluster-level access. The extension can intercept sensitive data, rewrite cluster state, or interrupt workloads across its granted scope. |
| CCC.K8S.TH12 | Admission Controls are Bypassed | Admission policies that omit resources, namespaces, or API paths may allow a Kubernetes request to be accepted without the intended validation or mutation. Workloads and configuration that violate security requirements can then be persisted, weakening cluster-policy integrity and exposing workloads to unauthorized access or disruption. |