An operator, controller, admission webhook, or managed extension installed without verified provenance and constrained permissions may execute untrusted code with cluster-level access. The extension can intercept sensitive data, rewrite cluster state, or interrupt workloads across its granted scope.
Cluster Extensions Execute Untrusted Code
CCC.K8S.TH08
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP14 | Managed Cluster Extensions | The service can manage the installation and lifecycle of supported extensions for networking, storage, policy, observability, and workload management. |
| CCC.K8S.CP18 | Admission Policy Enforcement | The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN08 | Allowlist CSP-Provided Cluster Add-ons and Extensions | Restrict enabled CSP-provided cluster add-ons, extensions, and managed features to an organization-controlled allowlist. |