Node administrative interfaces reachable without sufficient authentication or network restriction may expose node metadata, workload credentials, logs, or execution functions. The node can then be queried or controlled outside the intended management path, allowing credential disclosure, unauthorized host changes, or disruption of scheduled workloads.
Node Administrative Interfaces Expose Cluster Credentials
CCC.K8S.TH14
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP02 | Managed Worker Pools | The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads. |
| CCC.K8S.CP03 | Abstracted Worker Infrastructure | The service may be configured to abstract worker infrastructure so that provisioning, scaling, patching, and replacement occur without exposing individual nodes to the user. |
| CCC.K8S.CP19 | Workload Isolation Controls | The service can separate workloads with security contexts, namespace boundaries, scheduling constraints, and runtime isolation settings. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN12 | Restrict Node Administrative Access | Block untrusted or unauthenticated paths to worker-node administration, kubelet interfaces, and instance metadata. |