[Copilot]

Untrusted kubeconfigs can launch arbitrary local processes through exec credential plugins. This adds application-controlled authorization without requiring callers to parse and inspect kubeconfig themselves.

• Policy API: Immutable AllowAll (default), DenyAll, and Allowlist policies across configuration builders, including Classic and AOT. Existing API signatures remain available.
• Enforcement: Checks initial execution and token refresh before process launch. Denials throw ExecCredentialPluginDeniedException; kubeconfig cannot override the application policy.
• Allowlist semantics: Match basenames or exact absolute paths, including Windows UNC paths. Empty lists deny all; invalid entries and quoted commands are rejected. Allowlist mode also rejects kubeconfig-supplied environment overrides to prevent command redirection and loader injection.
• Trust boundaries: Basenames permit any matching executable location. Arguments and executable contents are not restricted; the policy is not a sandbox.

var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(
    kubeConfigPath,
    execCredentialPluginPolicy: ExecCredentialPluginPolicy.DenyAll);

// Or explicitly approve credential plugins:
var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(
    kubeConfigPath,
    execCredentialPluginPolicy: ExecCredentialPluginPolicy.Allowlist(
        "kubelogin",
        @"C:\Program Files\Contoso\trusted-plugin.exe"));

• Fixes Add security policy support for kubeconfig exec credential plugins #1918

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: brendandburns / name: Brendan Burns (0052976, 28b52c0, 2bb6e7b, 547c92d, 58ff291, 7161cfe, 7c19b1a, 8697a61, 93d8280, abacfad, b22aa93, b48d2b7, e275112, e5ad6ca)

[Copilot]

Copilot review overview

🟡 Changes recommended

Kubeconfig-controlled environment variables can bypass allowlisted command restrictions and still enable arbitrary code execution.

Review effort: Balanced
Findings: 1

Open (1)

• Allowlist ignores kubeconfig-controlled environment during execution · New

[Copilot]

Copilot review overview

🔵 Needs a closer look

Security-sensitive process execution changes span multiple target variants, while the PR explicitly indicates build and security validation remain incomplete.

Review effort: Balanced
Findings: 1

Open (1)

• Allowlist ignores kubeconfig-controlled environment during execution

[brendandburns]

@copilot can you add documentation that this is intended for defense in depth and is not a hard security boundary, loading a kubeconfig from an untrusted source is an inherently dangerous activity and should be handled as part of an overall security model, not relying exclusively on this capability.

[Copilot]

@copilot can you add documentation that this is intended for defense in depth and is not a hard security boundary, loading a kubeconfig from an untrusted source is an inherently dangerous activity and...

Added the README clarification in commit 36876d0: the policy is defense in depth, not a hard security boundary, and untrusted kubeconfigs must be addressed within the application's overall security model.

[Copilot]

🟡 Changes recommended

Allowlist mode permits HOME overrides that can inject startup code into an approved Python-based credential helper.

2 open issues

• Reject HOME overrides to prevent usercustomize.py injection · New
• Normalize Windows path casing during executable matching

2 resolved since last review

• Block .NET profiler environment variables in allowlist mode
• Avoid probing unapproved UNC paths

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Allowlist environment filtering still permits runtime redirection and Bash function injection that can execute unapproved code.

2 open issues

• Block DOTNET_ROOT and BASH_FUNC environment injection · New
• Reject HOME overrides to prevent usercustomize.py injection

1 resolved since last review

• Normalize Windows path casing during executable matching

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The environment filter still permits BASH_FUNC_ overrides, allowing a kubeconfig to inject code into an allowlisted Bash credential script despite blocking BASH_ENV.

No open issues 🎉

2 resolved since last review

• Block DOTNET_ROOT and BASH_FUNC environment injection
• Reject HOME overrides to prevent usercustomize.py injection

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Critical code-execution risks in executable authorization and environment-variable handling require human security assessment.

No open issues 🎉

_{Review effort: Balanced}

[brendandburns]

/lgtm
/approve

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, Copilot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [brendandburns]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment