gcp-gke-get-credentials
container.clusters.getCredentials yields a kubeconfig (endpoint + CA) authenticated with the caller's GCP token; k8s RBAC then governs what actions are permitted.
match (effective permission)
{
"action": "container.clusters.getCredentials",
"resource_type": "container.googleapis.com/Cluster"
}
emit
| source type | Identity |
|---|---|
| target type | KubernetesCluster |
| source | <principal> |
| target | <GKE cluster> |
| permissions | container.clusters.getCredentials |
| conditions | iam_permission api_enabled |
| state logic | ACTIVE if the principal has container.clusters.getCredentials at the project/cluster scope and the Kubernetes Engine API is enabled; CONDITIONAL(api_enabled) if the GKE API is disabled in the project. |
Narrative
{principal.name} can fetch a kubeconfig for {cluster.name} (container.clusters.getCredentials), authenticating to the cluster API server with its GCP OAuth token; its k8s RBAC bindings then determine what actions it may perform.
Raw rule rules/derived/gcp/gke.yaml
id: gcp-gke-get-credentials
emits: CanRead
description: container.clusters.getCredentials yields a kubeconfig (endpoint + CA) authenticated with
the caller's GCP token; k8s RBAC then governs what actions are permitted.
match_effective_permission:
action: container.clusters.getCredentials
resource_type: container.googleapis.com/Cluster
emit:
source_type: Identity
target_type: KubernetesCluster
source: <principal>
target: <GKE cluster>
permissions:
- container.clusters.getCredentials
conditions:
- iam_permission
- api_enabled
state_logic: ACTIVE if the principal has container.clusters.getCredentials at the project/cluster scope
and the Kubernetes Engine API is enabled; CONDITIONAL(api_enabled) if the GKE API is disabled in the
project.
confidence: 0.95
derived_from:
- '<effective iam_permission: container.clusters.getCredentials on cluster>'
false_positive_note: "container.clusters.getCredentials does NOT grant admin access by itself. The kubeconfig\
\ uses the caller's GCP OAuth token; k8s RBAC determines privilege. Without a ClusterRoleBinding to\
\ cluster-admin or system:masters, the caller has only its RBAC-granted permissions. Do NOT conflate\
\ with container.clusters.get (read-only metadata, no cluster authentication). container.clusters.get\
\ alone is pure recon \u2014 emit only CanRead on the cluster metadata, not on authenticated cluster\
\ access."
narrative: '{principal.name} can fetch a kubeconfig for {cluster.name} (container.clusters.getCredentials),
authenticating to the cluster API server with its GCP OAuth token; its k8s RBAC bindings then determine
what actions it may perform.'