Affected by GO-2022-0617 and 6 other vulnerabilities

GO-2022-0617: WITHDRAWN: Potential proxy IP restriction bypass in Kubernetes in k8s.io/kubernetes

GO-2024-2994: Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes

GO-2025-3465: Node Denial of Service via kubelet Checkpoint API in k8s.io/kubernetes

GO-2025-3521: Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes

GO-2025-3522: Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API in k8s.io/kubernetes

GO-2025-3547: Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

GO-2025-3915: Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes

signing

package

v1.29.0 Latest Latest Go to latest Published: Dec 13, 2023 License: Apache-2.0 Imports: 11 Imported by: 5

Details

View Source

const PluginName = "CertificateSigning"

PluginName is a string with the name of the plugin

This section is empty.

func Register(plugins *admission.Plugins)

Register registers a plugin

type Plugin struct {
	*admission.Handler
	// contains filtered or unexported fields
}

Plugin holds state for and implements the admission plugin.

func NewPlugin() *Plugin

NewPlugin creates a new CSR approval admission plugin

func (p *Plugin) SetAuthorizer(authz authorizer.Authorizer)

SetAuthorizer sets the authorizer.

func (p *Plugin) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error

Validate verifies that the requesting user has permission to sign CertificateSigningRequests for the specified signerName.

func (p *Plugin) ValidateInitialization() error

ValidateInitialization ensures an authorizer is set.