Kubernetes has no way to revoke a client certificate, and the certificates it issues are often valid for years. A leaked one, or a non-expiring service account token, gives lasting access that is hard to take back without re-keying the cluster.
- Authenticate people through an external identity provider with OIDC or structured JWT authentication and MFA, and keep certificates for break-glass use only.
- Use short-lived tokens from the TokenRequest API (
kubectl create token --duration) instead of long-lived service account token Secrets. - Disable anonymous authentication on the API server and kubelet where you control them; on managed clusters, grant nothing to
system:unauthenticated. - Create a dedicated service account per workload and stop mounting the default token.
Guides on this site
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Practice
- Privileged container lab: Reject a privileged workload before deployment · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- Verify Kubernetes admission and network boundaries · Local project
Gaps on this site
The managed Kubernetes guide covers provider identity integration and disabling local accounts. No guide here sets up OIDC or structured authentication for a cluster you run yourself.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.