Shivangi Patel

Threshold-Signed Service-Account Tokens for Kubernetes

At any time, one signing key signs every new service-account token in a Kubernetes cluster, and a copy of it lets an attacker mint tokens offline for any identity. We present an external signer that removes that key: it plugs into the stable ExternalJWTSigner interface (KEP-740)...

Service-Account Token Signing in Kubernetes

At any time, one active signing authority signs every new service-account token in a Kubernetes cluster. Whoever obtains that key can mint tokens that authenticate as any service account, offline and without contacting the cluster; authorization and admission control then evaluat...