● Covered by 1 source · 1 reportMedium impact1 neutral
Kubernetes YAML Misconfiguration Can Lead to Google Cloud Organization Takeover
Key points
- Service account keys pose security risks due to secret sprawl.
- GitOps with Kubernetes controllers like KCC removes direct developer credentials.
- KCC's service account (KCC GSA) can have broad organizational permissions.
- A malicious IAMPolicyMember YAML can exploit KCC GSA permissions.
The Problem with Cloud Credentials
Developers traditionally require service account keys, often JSON files, to authenticate and create cloud resources. These files are prone to being copied, emailed, committed to repositories, and forgotten, leading to 'secret sprawl'. This makes tracking and rotating credentials difficult, posing a significant security risk, especially when team members depart.
GitOps and Kubernetes Controllers
The Kubernetes community addresses credential management through GitOps operators or controllers. Developers define desired resources in YAML configuration files, commit them to Git, and apply them to a Kubernetes cluster. A controller within the cluster then reads these files and creates or updates cloud resources on the developer's behalf, eliminating the need for developers to handle cloud credentials directly.
Google Kubernetes Config Connector (KCC)
Google's implementation of this system is Google Kubernetes Config Connector (KCC), typically running in a Google Kubernetes Engine (GKE) cluster. KCC monitors configuration files for Google Cloud resources and interacts with the Google Cloud API to manage them. KCC authenticates to Google Cloud using Workload Identity via a Google service account (KCC GSA) controlled by the platform team.
The Vulnerability
The KCC GSA often possesses broad permissions, such as 'roles/owner' or 'roles/resourcemanager.organizationAdmin', because KCC may manage infrastructure across multiple projects, folders, or an entire organization. A developer submitting a malicious IAMPolicyMember resource, for example, could exploit these extensive KCC GSA permissions to grant an application unauthorized access or control over the Google Cloud organization.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A misconfigured Kubernetes YAML file, when used with Google Kubernetes Config Connector (KCC), can grant an attacker broad control over an entire Google Cloud organization. This vulnerability arises because KCC's service account often holds extensive permissions to manage infrastructure across multiple projects or the entire organization.